diff --git a/snippets/dashboard-config.mdx b/snippets/dashboard-config.mdx
index 6cc78f40c6..206ca3abc9 100644
--- a/snippets/dashboard-config.mdx
+++ b/snippets/dashboard-config.mdx
@@ -158,6 +158,30 @@ Type: `bool`
disables implicit prepared statement usage
+### storage.main.postgres.max_open_connections
+ENV: TYK_DB_STORAGE_MAIN_POSTGRES_MAXOPENCONNECTIONS
+Type: `int`
+
+Maximum number of open connections to the database per connection pool. Dashboard maintains 8 connection pools. 0 (default) means unlimited.
+
+### storage.main.postgres.max_idle_connections
+ENV: TYK_DB_STORAGE_MAIN_POSTGRES_MAXIDLECONNECTIONS
+Type: `int`
+
+Maximum number of idle connections that will be kept in each connection pool. Dashboard maintains 8 connection pools. 0 (default) uses the Go default which is currently 2.
+
+### storage.main.postgres.connection_max_lifetime
+ENV: TYK_DB_STORAGE_MAIN_POSTGRES_CONNECTIONMAXLIFETIME
+Type: `string`
+
+Maximum length of time that a connection may be reused, as a Go duration string (e.g. "30m"). Empty (default) means connections are reused forever.
+
+### storage.main.postgres.connection_max_idle_time
+ENV: TYK_DB_STORAGE_MAIN_POSTGRES_CONNECTIONMAXIDLETIME
+Type: `string`
+
+Maximum length of time a connection may sit idle before being closed, as a Go duration string (e.g. "5m"). Empty (default) means idle connections are never closed for being idle.
+
### storage.main.mysql
Connection settings for a MySQL database
@@ -249,6 +273,30 @@ Type: `bool`
disables implicit prepared statement usage
+### storage.analytics.postgres.max_open_connections
+ENV: TYK_DB_STORAGE_ANALYTICS_POSTGRES_MAXOPENCONNECTIONS
+Type: `int`
+
+Maximum number of open connections to the database per connection pool. Dashboard maintains 8 connection pools. 0 (default) means unlimited.
+
+### storage.analytics.postgres.max_idle_connections
+ENV: TYK_DB_STORAGE_ANALYTICS_POSTGRES_MAXIDLECONNECTIONS
+Type: `int`
+
+Maximum number of idle connections that will be kept in each connection pool. Dashboard maintains 8 connection pools. 0 (default) uses the Go default which is currently 2.
+
+### storage.analytics.postgres.connection_max_lifetime
+ENV: TYK_DB_STORAGE_ANALYTICS_POSTGRES_CONNECTIONMAXLIFETIME
+Type: `string`
+
+Maximum length of time that a connection may be reused, as a Go duration string (e.g. "30m"). Empty (default) means connections are reused forever.
+
+### storage.analytics.postgres.connection_max_idle_time
+ENV: TYK_DB_STORAGE_ANALYTICS_POSTGRES_CONNECTIONMAXIDLETIME
+Type: `string`
+
+Maximum length of time a connection may sit idle before being closed, as a Go duration string (e.g. "5m"). Empty (default) means idle connections are never closed for being idle.
+
### storage.analytics.mysql
Connection settings for a MySQL database
@@ -337,6 +385,30 @@ Type: `bool`
disables implicit prepared statement usage
+### storage.logs.postgres.max_open_connections
+ENV: TYK_DB_STORAGE_LOGS_POSTGRES_MAXOPENCONNECTIONS
+Type: `int`
+
+Maximum number of open connections to the database per connection pool. Dashboard maintains 8 connection pools. 0 (default) means unlimited.
+
+### storage.logs.postgres.max_idle_connections
+ENV: TYK_DB_STORAGE_LOGS_POSTGRES_MAXIDLECONNECTIONS
+Type: `int`
+
+Maximum number of idle connections that will be kept in each connection pool. Dashboard maintains 8 connection pools. 0 (default) uses the Go default which is currently 2.
+
+### storage.logs.postgres.connection_max_lifetime
+ENV: TYK_DB_STORAGE_LOGS_POSTGRES_CONNECTIONMAXLIFETIME
+Type: `string`
+
+Maximum length of time that a connection may be reused, as a Go duration string (e.g. "30m"). Empty (default) means connections are reused forever.
+
+### storage.logs.postgres.connection_max_idle_time
+ENV: TYK_DB_STORAGE_LOGS_POSTGRES_CONNECTIONMAXIDLETIME
+Type: `string`
+
+Maximum length of time a connection may sit idle before being closed, as a Go duration string (e.g. "5m"). Empty (default) means idle connections are never closed for being idle.
+
### storage.logs.mysql
Connection settings for a MySQL database
@@ -428,6 +500,30 @@ Type: `bool`
disables implicit prepared statement usage
+### storage.uptime.postgres.max_open_connections
+ENV: TYK_DB_STORAGE_UPTIME_POSTGRES_MAXOPENCONNECTIONS
+Type: `int`
+
+Maximum number of open connections to the database per connection pool. Dashboard maintains 8 connection pools. 0 (default) means unlimited.
+
+### storage.uptime.postgres.max_idle_connections
+ENV: TYK_DB_STORAGE_UPTIME_POSTGRES_MAXIDLECONNECTIONS
+Type: `int`
+
+Maximum number of idle connections that will be kept in each connection pool. Dashboard maintains 8 connection pools. 0 (default) uses the Go default which is currently 2.
+
+### storage.uptime.postgres.connection_max_lifetime
+ENV: TYK_DB_STORAGE_UPTIME_POSTGRES_CONNECTIONMAXLIFETIME
+Type: `string`
+
+Maximum length of time that a connection may be reused, as a Go duration string (e.g. "30m"). Empty (default) means connections are reused forever.
+
+### storage.uptime.postgres.connection_max_idle_time
+ENV: TYK_DB_STORAGE_UPTIME_POSTGRES_CONNECTIONMAXIDLETIME
+Type: `string`
+
+Maximum length of time a connection may sit idle before being closed, as a Go duration string (e.g. "5m"). Empty (default) means idle connections are never closed for being idle.
+
### storage.uptime.mysql
Connection settings for a MySQL database
@@ -628,14 +724,47 @@ Type: `int`
Set the number of maximum connections in the Redis connection pool, which defaults to 500. Set to a higher value if you are expecting more traffic.
+### redis_iam_auth
+RedisIAMAuth configures cloud IAM-based authentication for the Redis/Valkey
+connection, using short-lived tokens instead of a static password.
+
+### redis_iam_auth.provider
+ENV: TYK_DB_REDISIAMAUTH_PROVIDER
+Type: `string`
+
+Provider selects the cloud IAM provider. Currently supported: "gcp"
+(GCP Memorystore for Valkey and Redis Cluster).
+
+### redis_iam_auth.service_account
+ENV: TYK_DB_REDISIAMAUTH_SERVICEACCOUNT
+Type: `string`
+
+ServiceAccount, for GCP, optionally impersonates this service account to
+mint tokens instead of using the ambient Application Default Credentials
+identity. Leave empty to use the workload's own identity (Workload Identity
+on GKE, or GOOGLE_APPLICATION_CREDENTIALS).
+
+### redis_iam_auth.token_refresh_before_expiry
+ENV: TYK_DB_REDISIAMAUTH_TOKENREFRESHBEFOREEXPIRY
+Type: `string`
+
+The access token issued by the IAM will be refreshed before expiry.
+Set the time period before expiry when that refresh will take place as
+a human readable duration (for example "2m30s", "5m").
+Defaults to "5m" (five minutes) when empty.
+
+### redis_iam_auth.enabled
+ENV: TYK_DB_REDISIAMAUTH_ENABLED
+Type: `bool`
+
+Set to true to use IAM-based authentication for this storage connection.
+
### force_api_defaults
ENV: TYK_DB_FORCEAPIDEFAULTS
Type: `bool`
If set to true, this forces the [listenPath.strip](/api-management/gateway-config-tyk-oas#listenpath) setting to true for all APIs created or updated through the Tyk Dashboard API or UI.
-The default value is `false`
-
### notify_on_change
ENV: TYK_DB_NOTIFYONCHANGE
Type: `bool`
@@ -1007,6 +1136,12 @@ Type: `bool`
ForbidAdminResetAccessToken is a security feature that allows you to prevent user admins from resetting the Dashboard API access tokens of other users. The default is `false`, however we recommend setting this to `true` for enhanced security.
+### security.allowed_examples_urls
+ENV: TYK_DB_SECURITY_ALLOWEDEXAMPLESURLS
+Type: `[]string`
+
+AllowedExamplesURLs is a list of exact URLs that are allowed for fetching example API configurations. Only exact URL matches will be permitted when using the /api/examples endpoints. If not configured, defaults to official Tyk example repository URLs.
+
### ui
This section controls various settings for the look and feel of the Dashboard UI.
@@ -1076,27 +1211,6 @@ Enabled is a boolean flag that enables the onboarding quick start wizard.
### ui.notifications
Notifications configures the behavior of toast notifications displayed in the UI.
-### ui.notifications.duration
-Duration controls how long each class of toast notification is displayed.
-
-### ui.notifications.duration.success
-ENV: TYK_DB_UI_NOTIFICATIONS_DURATION_SUCCESS
-Type: `int`
-
-Duration in milliseconds for success notifications.
-
-### ui.notifications.duration.warning
-ENV: TYK_DB_UI_NOTIFICATIONS_DURATION_WARNING
-Type: `int`
-
-Duration in milliseconds for warning notifications.
-
-### ui.notifications.duration.error
-ENV: TYK_DB_UI_NOTIFICATIONS_DURATION_ERROR
-Type: `int`
-
-Duration in milliseconds for error notifications.
-
### home_dir
ENV: TYK_DB_HOMEDIR
Type: `string`
@@ -1436,9 +1550,30 @@ Type: `string`
You can now configure the log format to be either the standard or json format
If not set or left empty, it will default to `standard`.
+### log_level
+ENV: TYK_DB_LOGLEVEL
+Type: `string`
+
+Configure the log verbosity. Valid values are: debug, info, warn, error.
+The system level TYK_LOGLEVEL takes precedence over this field when set.
+If unset, defaults to info.
+
### allow_unsafe_policy_ids
ENV: TYK_DB_ALLOWUNSAFEPOLICYIDS
Type: `bool`
AllowUnsafePolicyIds allows the use of non-standard characters in policy identifiers (default: false). The standard characters are alphanumeric characters plus underscore (_), hyphen (-), dot (.) and tilde (~). The use of other characters in IDs can cause unpredictable behavior and is not recommended.
+### kv
+ENV: TYK_DB_KV
+Type: `kv.Config`
+
+KV defines named secret stores (such as HashiCorp Vault, Consul, environment
+variables, or inline values) that other configuration values can reference.
+This lets sensitive settings like database credentials or the admin secret
+be kept in an external store instead of the config file; each referenced
+value is resolved from its store once, at startup. Store definitions may be
+set in the config file or supplied as a JSON object through the
+TYK_DB_KV_STORES environment variable; the environment overrides and adds
+stores by name, leaving file-defined stores it does not name untouched.
+
diff --git a/snippets/gateway-config.mdx b/snippets/gateway-config.mdx
index 196c8af9d4..d50467f605 100644
--- a/snippets/gateway-config.mdx
+++ b/snippets/gateway-config.mdx
@@ -714,6 +714,42 @@ Maximum decompressed size (in bytes) for API definitions and Policies when using
This limit prevents memory exhaustion during decompression.
Defaults to 104857600 (100MB).
+### storage.iam_auth
+Configure the cloud provider's Identity and Access Management (IAM)
+authentication solution for temporal storage (for example, GCP MemoryStore IAM)
+instead of the traditional fixed username and password.
+
+### storage.iam_auth.enabled
+ENV: TYK_GW_STORAGE_IAMAUTH_ENABLED
+Type: `bool`
+
+Set to true to use IAM-based authentication for this storage connection.
+
+### storage.iam_auth.provider
+ENV: TYK_GW_STORAGE_IAMAUTH_PROVIDER
+Type: `string`
+
+Provider selects the cloud IAM provider. Currently supported: "gcp"
+(GCP Memorystore for Valkey and Redis Cluster).
+
+### storage.iam_auth.service_account
+ENV: TYK_GW_STORAGE_IAMAUTH_SERVICEACCOUNT
+Type: `string`
+
+ServiceAccount, for GCP, optionally impersonates this service account to
+mint tokens instead of using the ambient Application Default Credentials
+identity. Leave empty to use the workload's own identity (Workload Identity
+on GKE, or GOOGLE_APPLICATION_CREDENTIALS).
+
+### storage.iam_auth.token_refresh_before_expiry
+ENV: TYK_GW_STORAGE_IAMAUTH_TOKENREFRESHBEFOREEXPIRY
+Type: `string`
+
+The access token issued by the IAM will be refreshed before expiry.
+Set the time period before expiry when that refresh will take place as
+a human readable duration (for example "2m30s", "5m").
+Defaults to "5m" (five minutes) when empty.
+
### disable_dashboard_zeroconf
ENV: TYK_GW_DISABLEDASHBOARDZEROCONF
Type: `bool`
@@ -1248,6 +1284,13 @@ Type: `int`
GracefulShutdownTimeoutDuration sets how many seconds the gateway should wait for an existing connection
to finish before shutting down the server. Defaults to 30 seconds.
+### graceful_shutdown_delay_seconds
+ENV: TYK_GW_GRACEFULSHUTDOWNDELAYSECONDS
+Type: `int`
+
+GracefulShutdownDelaySeconds sets how many seconds the gateway will wait before proceeding with a graceful shutdown.
+During delay and shutdown the readiness endpoint will respond with 503 StatusServiceUnavailable.
+
### oauth_refresh_token_expire
ENV: TYK_GW_OAUTHREFRESHEXPIRE
Type: `int64`
@@ -1540,6 +1583,42 @@ Minimum TLS version that is supported.
Options: ["1.0", "1.1", "1.2", "1.3"].
Defaults to "1.2".
+### analytics_storage.iam_auth
+Configure the cloud provider's Identity and Access Management (IAM)
+authentication solution for temporal storage (for example, GCP MemoryStore IAM)
+instead of the traditional fixed username and password.
+
+### analytics_storage.iam_auth.enabled
+ENV: TYK_GW_ANALYTICSSTORAGE_IAMAUTH_ENABLED
+Type: `bool`
+
+Set to true to use IAM-based authentication for this storage connection.
+
+### analytics_storage.iam_auth.provider
+ENV: TYK_GW_ANALYTICSSTORAGE_IAMAUTH_PROVIDER
+Type: `string`
+
+Provider selects the cloud IAM provider. Currently supported: "gcp"
+(GCP Memorystore for Valkey and Redis Cluster).
+
+### analytics_storage.iam_auth.service_account
+ENV: TYK_GW_ANALYTICSSTORAGE_IAMAUTH_SERVICEACCOUNT
+Type: `string`
+
+ServiceAccount, for GCP, optionally impersonates this service account to
+mint tokens instead of using the ambient Application Default Credentials
+identity. Leave empty to use the workload's own identity (Workload Identity
+on GKE, or GOOGLE_APPLICATION_CREDENTIALS).
+
+### analytics_storage.iam_auth.token_refresh_before_expiry
+ENV: TYK_GW_ANALYTICSSTORAGE_IAMAUTH_TOKENREFRESHBEFOREEXPIRY
+Type: `string`
+
+The access token issued by the IAM will be refreshed before expiry.
+Set the time period before expiry when that refresh will take place as
+a human readable duration (for example "2m30s", "5m").
+Defaults to "5m" (five minutes) when empty.
+
### liveness_check.check_duration
ENV: TYK_GW_LIVENESSCHECK_CHECKDURATION
Type: `time.Duration`
@@ -1597,6 +1676,32 @@ Type: `int32`
If you set `disable_regexp_cache` to `false`, you can use this setting to limit how long the regular expression cache is kept for in seconds.
The default is 60 seconds. This must be a positive value. If you set to 0 this uses the default value.
+### regexp_cache_max_entries
+ENV: TYK_GW_REGEXPCACHEMAXENTRIES
+Type: `int`
+
+RegexpCacheMaxEntries caps the per-cache LRU size for the regex
+compile caches. Defaults to 5000 when unset (0).
+To opt into the legacy unbounded cache, set `disable_regexp_cache_bound` to true instead.
+
+### disable_regexp_cache_bound
+ENV: TYK_GW_DISABLEREGEXPCACHEBOUND
+Type: `bool`
+
+DisableRegexpCacheBound opts into the legacy unbounded regex compile
+cache (no size eviction). Only safe when the distinct-pattern keyspace
+is naturally bounded by API/session shape. The default (`false`) keeps the LRU bound active.
+
+### disable_auto_max_procs
+ENV: TYK_GW_DISABLEAUTOMAXPROCS
+Type: `bool`
+
+DisableAutoMaxProcs opts out of `automaxprocs` GOMAXPROCS adjustment.
+By default Tyk aligns GOMAXPROCS with the container's cgroup CPU quota
+Set to `true` only if you are pinning GOMAXPROCS yourself or
+running outside a CPU-quota-aware environment. No-op outside cgroup
+CPU-quota environments either way.
+
### local_session_cache
Tyk can cache some data locally, this can speed up lookup times on a single node and lower the number of connections and operations being done on Redis. It will however introduce a slight delay when updating or modifying keys as the cache must expire.
This does not affect rate limiting.
@@ -1737,6 +1842,42 @@ Minimum TLS version that is supported.
Options: ["1.0", "1.1", "1.2", "1.3"].
Defaults to "1.2".
+### cache_storage.iam_auth
+Configure the cloud provider's Identity and Access Management (IAM)
+authentication solution for temporal storage (for example, GCP MemoryStore IAM)
+instead of the traditional fixed username and password.
+
+### cache_storage.iam_auth.enabled
+ENV: TYK_GW_CACHESTORAGE_IAMAUTH_ENABLED
+Type: `bool`
+
+Set to true to use IAM-based authentication for this storage connection.
+
+### cache_storage.iam_auth.provider
+ENV: TYK_GW_CACHESTORAGE_IAMAUTH_PROVIDER
+Type: `string`
+
+Provider selects the cloud IAM provider. Currently supported: "gcp"
+(GCP Memorystore for Valkey and Redis Cluster).
+
+### cache_storage.iam_auth.service_account
+ENV: TYK_GW_CACHESTORAGE_IAMAUTH_SERVICEACCOUNT
+Type: `string`
+
+ServiceAccount, for GCP, optionally impersonates this service account to
+mint tokens instead of using the ambient Application Default Credentials
+identity. Leave empty to use the workload's own identity (Workload Identity
+on GKE, or GOOGLE_APPLICATION_CREDENTIALS).
+
+### cache_storage.iam_auth.token_refresh_before_expiry
+ENV: TYK_GW_CACHESTORAGE_IAMAUTH_TOKENREFRESHBEFOREEXPIRY
+Type: `string`
+
+The access token issued by the IAM will be refreshed before expiry.
+Set the time period before expiry when that refresh will take place as
+a human readable duration (for example "2m30s", "5m").
+Defaults to "5m" (five minutes) when empty.
+
### enable_bundle_downloader
ENV: TYK_GW_ENABLEBUNDLEDOWNLOADER
Type: `bool`
@@ -1883,8 +2024,9 @@ If not set or left empty, it will default to `info`.
ENV: TYK_GW_LOGFORMAT
Type: `string`
-You can now configure the log format to be either the standard or json format
-If not set or left empty, it will default to `standard`.
+Configures the output format used for application logs.
+Allowed values are `text`, `json`, or `legacy`.
+If not set or left empty, it defaults to `text`.
### access_logs
AccessLogs configures the output for access logs.
@@ -1907,7 +2049,9 @@ Example: ["client_ip", "path"].
Template Options:
+- `api_id` will include the API ID.
- `api_key` will include the obfuscated or hashed key.
+- `api_name` will include the API name.
- `circuit_breaker_state` will include the circuit breaker state when applicable.
- `client_ip` will include the IP of the request.
- `error_source` will include the source of an error (e.g., ReverseProxy).
@@ -1917,6 +2061,7 @@ Template Options:
- `latency_total` will include the total latency of the request.
- `method` will include the request method.
- `org_id` will include the organization ID.
+- `original_path` will include the original request path before URL rewrites.
- `path` will include the path of the request.
- `protocol` will include the protocol of the request.
- `remote_addr` will include the remote address of the request.
@@ -2381,6 +2526,14 @@ is used in conjunction with TraceIDRatioBased. Using it with AlwaysOn or AlwaysO
effective since, in those cases, you're either recording everything or nothing, and there are no
intermediary decisions to consider. The default value for this option is false.
+### opentelemetry.traces.mcp
+ENV: TYK_GW_OPENTELEMETRY_TRACES_MCPTRACECONTEXT
+Type: `MCPTraceContextConfig`
+
+Configure from where Tyk should read an MCP request's W3C trace
+context (ordered, first-match-wins). If not set, the canonical
+default [{header}, {body, path: params._meta}] will be used.
+
### opentelemetry.metrics
Metrics holds the OpenTelemetry metrics configuration.
@@ -2716,12 +2869,6 @@ Type: `int64`
global session lifetime, in seconds.
-### kv.KV
-ENV: TYK_GW_KV_KV
-Type: `struct`
-
-See more details https://tyk.io/docs/tyk-self-managed/#store-configuration-with-key-value-store
-
### kv.consul.address
ENV: TYK_GW_KV_CONSUL_ADDRESS
Type: `string`
diff --git a/snippets/mdcb-config.mdx b/snippets/mdcb-config.mdx
index 4c50ccb0a5..f7e32290e8 100644
--- a/snippets/mdcb-config.mdx
+++ b/snippets/mdcb-config.mdx
@@ -126,7 +126,7 @@ SSL certificates used by your MDCB server. A list of certificate IDs or path to
ENV: TYK_MDCB_SECURITY_PRIVATECERTIFICATEENCODINGSECRET
Type: `string`
-If you are using encrypted private keys, this is the secret to use to decrypt them. This must match the secret used for Gateway and Dashboard as explained [here](/api-management/certificates#encryption-of-the-private-key).
+If you are using encrypted private keys, this is the secret to use to decrypt them. This must match the secret used for Gateway and Dashboard as explained [here](/api-management/certificates#certificate-data).
### storage
This section describes your centralised Redis DB. This will act as your main key store for all of your clusters.
@@ -275,6 +275,41 @@ Minimum TLS version that is supported.
Options: ["1.0", "1.1", "1.2", "1.3"].
Defaults to "1.2".
+### storage.iam_auth
+Configure the cloud provider's Identity and Access Management (IAM)
+solution for temporal storage (for example, GCP MemoryStore IAM)
+
+### storage.iam_auth.provider
+ENV: TYK_MDCB_STORAGE_IAMAUTH_PROVIDER
+Type: `string`
+
+Provider selects the cloud IAM provider. Currently supported: "gcp"
+(GCP Memorystore for Valkey and Redis Cluster).
+
+### storage.iam_auth.service_account
+ENV: TYK_MDCB_STORAGE_IAMAUTH_SERVICEACCOUNT
+Type: `string`
+
+ServiceAccount, for GCP, optionally impersonates this service account to
+mint tokens instead of using the ambient Application Default Credentials
+identity. Leave empty to use the workload's own identity (Workload Identity
+on GKE, or GOOGLE_APPLICATION_CREDENTIALS).
+
+### storage.iam_auth.token_refresh_before_expiry
+ENV: TYK_MDCB_STORAGE_IAMAUTH_TOKENREFRESHBEFOREEXPIRY
+Type: `string`
+
+The access token issued by the IAM will be refreshed before expiry.
+Set the time period before expiry when that refresh will take place as
+a human readable duration (for example "2m30s", "5m").
+Defaults to "5m" (five minutes) when empty.
+
+### storage.iam_auth.enabled
+ENV: TYK_MDCB_STORAGE_IAMAUTH_ENABLED
+Type: `bool`
+
+Set to true to use IAM-based authentication for this storage connection.
+
### analytics
configuration of the store of analytics
@@ -663,6 +698,41 @@ Minimum TLS version that is supported.
Options: ["1.0", "1.1", "1.2", "1.3"].
Defaults to "1.2".
+### analytics_storage.iam_auth
+Configure the cloud provider's Identity and Access Management (IAM)
+solution for temporal storage (for example, GCP MemoryStore IAM)
+
+### analytics_storage.iam_auth.provider
+ENV: TYK_MDCB_ANALYTICSSTORAGE_IAMAUTH_PROVIDER
+Type: `string`
+
+Provider selects the cloud IAM provider. Currently supported: "gcp"
+(GCP Memorystore for Valkey and Redis Cluster).
+
+### analytics_storage.iam_auth.service_account
+ENV: TYK_MDCB_ANALYTICSSTORAGE_IAMAUTH_SERVICEACCOUNT
+Type: `string`
+
+ServiceAccount, for GCP, optionally impersonates this service account to
+mint tokens instead of using the ambient Application Default Credentials
+identity. Leave empty to use the workload's own identity (Workload Identity
+on GKE, or GOOGLE_APPLICATION_CREDENTIALS).
+
+### analytics_storage.iam_auth.token_refresh_before_expiry
+ENV: TYK_MDCB_ANALYTICSSTORAGE_IAMAUTH_TOKENREFRESHBEFOREEXPIRY
+Type: `string`
+
+The access token issued by the IAM will be refreshed before expiry.
+Set the time period before expiry when that refresh will take place as
+a human readable duration (for example "2m30s", "5m").
+Defaults to "5m" (five minutes) when empty.
+
+### analytics_storage.iam_auth.enabled
+ENV: TYK_MDCB_ANALYTICSSTORAGE_IAMAUTH_ENABLED
+Type: `bool`
+
+Set to true to use IAM-based authentication for this storage connection.
+
### log_level
ENV: TYK_MDCB_LOGLEVEL
Type: `string`
@@ -725,7 +795,7 @@ Specifies the group key TTL in seconds. This key is used to prevent a group of g
ENV: TYK_MDCB_ENABLEOWNERSHIP
Type: `bool`
-Enables [API Ownership](/platform-management/api-ownership#enabling-api-ownership) in MDCB. If set, the Data Plane Gateways will load only APIs that are accessible by the user and user group associated with the Gateways' [slave_options.api_key](/tyk-oss-gateway/configuration#slave_options-api_key) used to connect to MDCB.
+Enables [API Ownership](/tyk-dashboard/rbac#enabling-api-ownership) in MDCB. If set, the Data Plane Gateways will load only APIs that are accessible by the user and user group associated with the Gateways' [slave_options.api_key](/tyk-oss-gateway/configuration#slave_options-api_key) used to connect to MDCB.
### escape_dots_in_oas_paths
ENV: TYK_MDCB_ESCAPEDOTSINOASPATHS
@@ -733,3 +803,16 @@ Type: `bool`
When enabled, dots in OAS field names are escaped with double underscores to prevent MongoDB field name conflicts, and unescaped on read.
+### kv
+ENV: TYK_MDCB_KV
+Type: `kv.Config`
+
+KV defines named secret stores (such as HashiCorp Vault, Consul, environment
+variables, or inline values) that other configuration values can reference.
+This lets sensitive settings like database credentials or the admin secret
+be kept in an external store instead of the config file; each referenced
+value is resolved from its store once, at startup. Store definitions may be
+set in the config file or supplied as a JSON object through the
+TYK_MDCB_KV_STORES environment variable; the environment overrides and adds
+stores by name, leaving file-defined stores it does not name untouched.
+
diff --git a/snippets/pump-config.mdx b/snippets/pump-config.mdx
index 5c2e5d6289..8bb17ca912 100644
--- a/snippets/pump-config.mdx
+++ b/snippets/pump-config.mdx
@@ -5077,6 +5077,42 @@ Type: `bool`
Set this to `true` to tell Pump to ignore database's cert validation.
Deprecated: use SSLInsecureSkipVerify instead.
+### analytics_storage_config.iam_auth
+Configure the cloud provider's Identity and Access Management (IAM)
+authentication solution for temporal storage (for example, GCP MemoryStore IAM)
+instead of the traditional fixed username and password.
+
+### analytics_storage_config.iam_auth.provider
+ENV: TYK_PMP_ANALYTICSSTORAGECONFIG_IAMAUTH_PROVIDER
+Type: `string`
+
+Provider selects the cloud IAM provider. Currently supported: "gcp"
+(GCP Memorystore for Valkey and Redis Cluster).
+
+### analytics_storage_config.iam_auth.service_account
+ENV: TYK_PMP_ANALYTICSSTORAGECONFIG_IAMAUTH_SERVICEACCOUNT
+Type: `string`
+
+ServiceAccount, for GCP, optionally impersonates this service account to
+mint tokens instead of using the ambient Application Default Credentials
+identity. Leave empty to use the workload's own identity (Workload Identity
+on GKE, or GOOGLE_APPLICATION_CREDENTIALS).
+
+### analytics_storage_config.iam_auth.token_refresh_before_expiry
+ENV: TYK_PMP_ANALYTICSSTORAGECONFIG_IAMAUTH_TOKENREFRESHBEFOREEXPIRY
+Type: `string`
+
+The access token issued by the IAM will be refreshed before expiry.
+Set the time period before expiry when that refresh will take place as
+a human readable duration (for example "2m30s", "5m").
+Defaults to "5m" (five minutes) when empty.
+
+### analytics_storage_config.iam_auth.enabled
+ENV: TYK_PMP_ANALYTICSSTORAGECONFIG_IAMAUTH_ENABLED
+Type: `bool`
+
+Set to true to use IAM-based authentication for this storage connection.
+
### analytics_storage_type
ENV: TYK_PMP_ANALYTICSSTORAGETYPE
Type: `string`
@@ -5199,3 +5235,16 @@ Type: `bool`
This option was intended to decode raw response payloads from base64 for all Pumps. However, it was never implemented and therefore has no functional effect. It has now been deprecated.
Deprecated: Use pump level raw_response_decoded configuration instead.
+### kv
+ENV: TYK_PMP_KV
+Type: `kv.Config`
+
+KV defines named secret stores (such as HashiCorp Vault, Consul, environment
+variables, or inline values) that other configuration values can reference.
+This lets sensitive settings like database credentials or the admin secret
+be kept in an external store instead of the config file; each referenced
+value is resolved from its store once, at startup. Store definitions may be
+set in the config file or supplied as a JSON object through the
+TYK_PMP_KV_STORES environment variable; the environment overrides and adds
+stores by name, leaving file-defined stores it does not name untouched.
+
diff --git a/snippets/x-tyk-gateway.mdx b/snippets/x-tyk-gateway.mdx
index 28ba953992..74393b678f 100644
--- a/snippets/x-tyk-gateway.mdx
+++ b/snippets/x-tyk-gateway.mdx
@@ -119,6 +119,11 @@ Proxy contains the configuration for an internal proxy.
Tyk classic API definition: `proxy.proxy_url`.
+**Field: `enforceTimeout` ([GlobalEnforceTimeout](#globalenforcetimeout))**
+EnforceTimeout contains the configuration related to API level timeout duration.
+
+Tyk classic API definition: `version_data.versions..global_enforce_timeout`.
+
### **Server**
Server contains the configuration that sets Tyk up to receive requests from the client applications.
@@ -603,6 +608,24 @@ Enabled determines if the proxy is active.
**Field: `url` (`string`)**
URL specifies the URL of the internal proxy.
+### **GlobalEnforceTimeout**
+
+GlobalEnforceTimeout holds the configuration for enforcing a timeout at the API level.
+
+**Field: `enabled` (`boolean`)**
+Enabled is a boolean flag. If set to `true`, the API-level timeout will be enforced
+across all endpoints that do not have an endpoint-level timeout configured.
+
+
+Tyk classic API definition: `version_data.versions..global_enforce_timeout_disabled` (negated).
+
+**Field: `duration` (`time.ReadableDuration`)**
+Duration is the configured timeout using a human-readable format (e.g. `5s`, `500ms`, `1m`).
+Supported units: ms, s, m.
+
+
+Tyk classic API definition: `version_data.versions..global_enforce_timeout`.
+
### **ListenPath**
ListenPath is the base path on Tyk to which requests for this API
@@ -697,6 +720,10 @@ ProtectedResourceMetadata configures OAuth 2.0 Protected Resource Metadata (RFC
for authorization server discovery. This is used by MCP clients to discover which
authorization server to use for accessing the API.
+Deprecated: Use SecuritySchemes[].OAuth2.ProtectedResourceMetadata instead.
+The new per-scheme location is the runtime source of truth; this top-level
+field is kept for downgrade safety and will be removed in a future major version.
+
**Field: `certificateAuth` ([CertificateAuth](#certificateauth))**
CertificateAuth represents certificate-based authentication configuration.
@@ -1188,8 +1215,6 @@ Tyk classic API definition: `session_lifetime_respects_key_expiration`.
### **ProtectedResourceMetadata**
-**Deprecated in Tyk 5.14.0.** Use `authentication.securitySchemes[name].oauth2.protectedResourceMetadata` ([OAuth2](#oauth2)) instead. Tyk Dashboard migrates existing configurations automatically on startup. This block remains for downgrade safety.
-
ProtectedResourceMetadata holds the configuration for OAuth 2.0 Protected Resource Metadata (RFC 9728).
It enables MCP clients to discover which authorization server protects this API resource.
@@ -1204,6 +1229,11 @@ explicitly:
On non-MCP APIs only static is meaningful; mirror is a no-op.
+Deprecated: Use OAuth2PRM (under SecuritySchemes[].OAuth2) instead.
+This type backs the legacy top-level Authentication.ProtectedResourceMetadata
+field; the new per-scheme location is the runtime source of truth and the
+legacy block is kept only for downgrade safety.
+
**Field: `enabled` (`boolean`)**
Enabled activates the Protected Resource Metadata endpoint.
@@ -1824,6 +1854,14 @@ Path is the path to shared object file in case of goplugin mode or path to JS co
Tyk classic API definition: `custom_middleware.pre[].path`, `custom_middleware.post_key_auth[].path`,.
`custom_middleware.post[].path`, `custom_middleware.response[].path`.
+**Field: `code` (`string`)**
+Code is the base64-encoded JS source code for inline plugin execution (goja driver).
+When non-empty, Code takes precedence over Path.
+
+
+Tyk classic API definition: `custom_middleware.pre[].code`, `custom_middleware.post_key_auth[].code`,.
+`custom_middleware.post[].code`, `custom_middleware.response[].code`.
+
**Field: `rawBodyOnly` (`boolean`)**
RawBodyOnly if set to true, do not fill body in request or response object.
@@ -2110,6 +2148,21 @@ ClientID is the application's ID.
**Field: `clientSecret` (`string`)**
ClientSecret is the application's secret.
+**Field: `method` (`string`)**
+Method controls how Tyk sends the client credentials to the upstream token
+endpoint. Valid values are `client_secret_basic` (RFC 6749 Section 2.3.1 —
+credentials in the Authorization header only, no fallback) and
+`client_secret_post` (credentials in the request body only, no fallback).
+Leave empty for the default auto-detect behaviour: Tyk tries the header
+first and falls back to the body on failure. Note this deliberately
+differs from the token-exchange `clientAuth.method`, where empty defaults
+to client_secret_basic — here empty must preserve the fallback so
+existing APIs keep working.
+
+
+Tyk classic API definition: `upstream_auth.oauth.client_credentials.method`.
+and `upstream_auth.oauth.password.method`.
+
### **CustomClaimValidationConfig**
CustomClaimValidationConfig defines the validation configuration for a custom JWT claim.
@@ -2138,6 +2191,163 @@ CustomClaimValidationType represents how a JWT claim should be validated.
This determines the validation logic used to check the claim value.
The validation behavior varies based on both the type selected and the claim's data type.
+### **DeriveWarning**
+
+DeriveWarning describes a non-fatal issue encountered while deriving
+tools — for example, a missing operationId or a source operation excluded by
+visibility controls.
+
+**Field: `Operation` (`string`)**
+Operation identifies the source operation that produced the warning.
+
+**Field: `Source` (`string`)**
+Source identifies the configured source selector when the warning came
+from proxy-side MCP primitive configuration.
+
+**Field: `ToolName` (`string`)**
+ToolName is the configured caller-facing primitive name, when present.
+
+**Field: `Method` (`string`)**
+Method is the HTTP method for the source operation.
+
+**Field: `Path` (`string`)**
+Path is the OAS path template for the source operation.
+
+**Field: `Reason` (`string`)**
+Reason explains why the source operation was skipped or warned.
+
+### **DerivedParamSerialization**
+
+DerivedParamSerialization describes how a path, query, or header parameter
+should be encoded when translating MCP tool arguments to a REST request.
+
+**Field: `sourceName` (`string`)**
+SourceName is the original REST parameter name used in the upstream
+request.
+
+**Field: `location` (`string`)**
+Location is the REST parameter location, such as path, query, or header.
+
+**Field: `style` (`string`)**
+Style is the OpenAPI serialization style for the parameter.
+
+**Field: `explode` (`boolean`)**
+Explode indicates whether arrays and objects should generate separate
+parameter values.
+
+**Field: `schemaType` (`string`)**
+SchemaType is the derived JSON schema type for the parameter value.
+
+### **DerivedPrimitive**
+
+DerivedPrimitive is the internal primitive-aware catalogue entry used by the
+REST-to-MCP derivation layer. V1 emits only tool primitives; resources are
+reserved for v2 without changing this catalogue shape again.
+
+**Field: `type` (`string`)**
+Type identifies the MCP primitive category.
+
+**Field: `tool` ([DerivedTool](#derivedtool))**
+Tool holds the derived tool descriptor for tool primitives.
+
+### **DerivedTool**
+
+DerivedTool is the runtime descriptor the adapter needs to translate
+a `tools/call` JSON-RPC envelope into an HTTP request against the
+source REST API.
+
+It carries everything the adapter middleware needs — method, path
+template, where each argument lives (path / query / header / body /
+body.), and the synthesised input JSON schema that is served
+back on `tools/list`.
+
+**Field: `` (`string`)**
+OperationID is the source REST operationId this tool calls.
+
+**Field: `` (`string`)**
+SourceKey identifies the source operation even when operationId is
+absent. OperationId-backed tools use "operationId:"; path+method
+fallbacks use "http: ".
+
+**Field: `` (`string`)**
+CanonicalName is the source-derived MCP tool name before any proxy-side
+alias is applied.
+
+**Field: `name` (`string`)**
+Name is the MCP tool name agents call.
+
+**Field: `description` (`string`)**
+Description is taken from the OAS operation summary or description.
+
+**Field: `` (`string`)**
+Method is the HTTP method (GET, POST, ...).
+
+**Field: `` (`string`)**
+PathTemplate is the OAS path template (e.g. "/orders/{id}").
+
+**Field: `` (`map[string]string`)**
+ParamLocations maps each argument name to its source location.
+Recognised values:
+ - "path"
+ - "query"
+ - "header"
+ - "body" (the whole JSON body)
+ - "body." (a single JSON body field)
+Locations are used internally by the REST-as-MCP adapter.
+
+**Field: `` (`map[string]string`)**
+ParamSourceNames maps each MCP-facing argument name back to the
+original REST parameter or body field name.
+
+**Field: `` (`map[string]DerivedParamSerialization`)**
+ParamSerializations maps each MCP-facing path/query/header argument to
+the source OpenAPI serialization method the adapter uses when rebuilding
+the upstream REST request.
+
+**Field: `` (`[]string`)**
+ParamOrder lists MCP-facing argument names in source derivation order.
+The adapter uses it when emitting ordered request components such as
+query strings.
+
+**Field: `` (`string`)**
+RequestBodyContentType is the selected source request body media type.
+Empty means JSON/default.
+
+**Field: `inputSchema` (`map[string]any`)**
+InputSchema is the JSON schema published in tools/list to describe
+the tool's accepted arguments. Built from the operation's
+parameters + requestBody.
+
+**Field: `annotations` ([DerivedToolAnnotations](#derivedtoolannotations))**
+Annotations are MCP tool annotations published in tools/list.
+
+**Field: `outputSchema` (`map[string]any`)**
+OutputSchema is the JSON schema published in tools/list to describe
+structuredContent returned by successful tools/call responses. When set,
+the REST-as-MCP adapter unmarshals successful JSON response bodies up to
+the adapter body cap to populate structuredContent; omit it for tools
+whose large or high-volume responses should stay text-only.
+
+### **DerivedToolAnnotations**
+
+DerivedToolAnnotations describes MCP tool annotations derived from the
+source REST operation and optional proxy-side overrides.
+
+**Field: `title` (`string`)**
+Title is a human-readable display name for the tool.
+
+**Field: `readOnlyHint` (`boolean`)**
+ReadOnlyHint indicates whether the tool is expected to avoid modifying state.
+
+**Field: `destructiveHint` (`boolean`)**
+DestructiveHint indicates whether the tool may perform destructive updates.
+
+**Field: `idempotentHint` (`boolean`)**
+IdempotentHint indicates whether repeated calls with the same arguments have the same effect.
+
+**Field: `openWorldHint` (`boolean`)**
+OpenWorldHint indicates whether the tool interacts with external systems.
+
### **EdgeEndpoint**
EdgeEndpoint represents an edge gateway endpoint configuration.
@@ -2188,13 +2398,20 @@ EnforceTimeout holds the configuration for enforcing request timeouts.
Enabled is a boolean flag. If set to `true`, requests will enforce a configured timeout.
-Tyk classic API definition: `version_data.versions..extended_paths.hard_timeouts[].disabled` (negated).
+Tyk classic API definition: `version_data.versions.{version-name}.extended_paths.hard_timeouts[].disabled` (negated).
**Field: `value` (`int`)**
Value is the configured timeout in seconds.
-Tyk classic API definition: `version_data.versions..extended_paths.hard_timeouts[].timeout`.
+Tyk classic API definition: `version_data.versions.{version-name}.extended_paths.hard_timeouts[].timeout`.
+Deprecated: Use Duration instead.
+
+**Field: `duration` (`string`)**
+Duration is the configured timeout duration. Supports sub-second values (e.g. "500ms", "5s").
+
+
+Tyk classic API definition: `version_data.versions.{version-name}.extended_paths.hard_timeouts[].duration`.
### **ErrorMatcher**
@@ -2562,14 +2779,22 @@ Tyk classic API definition: `external_oauth.providers[].jwt.expires_at_validatio
MCPPrimitive holds middleware configuration for MCP primitives (tools, resources, prompts).
It embeds Operation to reuse all standard middleware (rate limiting, transforms, caching, etc.).
-**Field: `security` (`[]map[string][]string`)**
-Security mirrors the OAS `security:` array shape for this primitive. Used by scope enforcement when `scopeSource` is `"operation"` or `"union"`. Each entry is an OR branch; scopes within an entry are AND-required.
+**Field: `security` (`openapi3.SecurityRequirements`)**
+Security mirrors the OAS `security:` array shape (one item per OR
+branch, each a map of scheme name → required scopes). It is the
+primitive-level equivalent of an OAS path operation's `security`
+field, since MCP primitives have no openapi3.Operation of their own.
+Read by the oauth2 scope-check middleware when scopeSource resolves
+to "operation" or "union".
-**Field: `scopeCheck` ([ScopeCheck](#scopecheck))**
-ScopeCheck overrides the API-level OAuth 2.0 scope enforcement for this primitive. Set `enabled: false` to exempt the primitive from scope checks.
+### **MCPToolView**
-**Field: `exchange` ([OAuth2Exchange](#oauth2exchange))**
-Exchange overrides the token exchange provider's default target for this primitive. Requires token exchange configured at the API level (Enterprise Edition only).
+MCPToolView is the proxy-specific list of MCP tools exposed by one
+REST-as-MCP proxy. Tool entries retain their canonical source operation
+fields so aliases can be mapped back before issuing REST requests.
+
+**Field: `tools` ([[]DerivedTool](#derivedtool))**
+Tools is the proxy-specific caller-facing tool catalogue.
### **MockResponse**
@@ -2640,197 +2865,275 @@ Notifications configures a URL trigger on key changes.
Tyk classic API definition: `notifications`.
-### **OAuthProvider**
-
-OAuthProvider holds the configuration for validation and introspection of OAuth tokens.
-
-**Field: `jwt` ([JWTValidation](#jwtvalidation))**
-JWT configures JWT validation.
-
-
-Tyk classic API definition: `external_oauth.providers[].jwt`.
-
-**Field: `introspection` ([Introspection](#introspection))**
-Introspection configures token introspection.
-
-
-Tyk classic API definition: `external_oauth.providers[].introspection`.
-
### **OAuth2**
-OAuth2 is the container for the OAS-native OAuth 2.0 security scheme. Configured under `server.authentication.securitySchemes[name]`.
+OAuth2 is the container for the OAS-native OAuth 2.0 security scheme.
+It holds the master Enabled toggle, the AuthSources inheritance from
+the standard Tyk security-scheme contract, and optional sub-blocks
+(currently ScopeCheck) that enable specific OAuth-flow features.
+
+Stored under
+x-tyk-api-gateway.server.authentication.securitySchemes[name].
**Field: `enabled` (`boolean`)**
-Enabled is the master switch for this scheme. When false the entire block is inert.
+Enabled is the master switch for this scheme. When false, the
+entire oauth2 block is inert.
**Field: `scopeCheck` ([OAuth2ScopeCheck](#oauth2scopecheck))**
-ScopeCheck enables OAS-native scope enforcement against the inbound token's claims.
+ScopeCheck enables OAS-native scope enforcement. See
+OAuth2ScopeCheck for the full configuration contract.
-**Field: `protectedResourceMetadata` ([OAuth2ProtectedResourceMetadata](#oauth2protectedresourcemetadata))**
-ProtectedResourceMetadata configures the RFC 9728 PRM document served for this scheme. Supersedes the deprecated top-level `authentication.protectedResourceMetadata` block.
+**Field: `protectedResourceMetadata` ([OAuth2PRM](#oauth2prm))**
+ProtectedResourceMetadata configures the RFC 9728 PRM document.
+New home for PRM; wins over the deprecated top-level
+authentication.protectedResourceMetadata when both are set.
**Field: `tokenExchange` ([OAuth2TokenExchange](#oauth2tokenexchange))**
-TokenExchange enables RFC 8693 token exchange. The inbound token is exchanged at the matched provider's IdP for a backend-scoped token before being forwarded upstream.
+TokenExchange enables RFC 8693 token exchange. Inbound user
+tokens are exchanged at the matched provider's IdP for a
+backend-audienced token before being forwarded upstream. See
+OAuth2TokenExchange for the full configuration contract.
----
+### **OAuth2ClientAuth**
-### **OAuth2ScopeCheck**
+OAuth2ClientAuth describes how Tyk authenticates to the IdP token endpoint.
+ClientSecret accepts env://, secrets://, vault://, consul:// prefixes.
-OAuth2ScopeCheck holds scope enforcement configuration for an `oauth2` security scheme. The required scopes themselves are declared in the OAS `security:` array.
+**Field: `method` (`string`)**
+Method selects the client-auth scheme. Supported values:
+ - "client_secret_basic" (RFC 6749 §2.3.1) — credentials in the
+ HTTP Authorization header.
+ - "client_secret_post" (RFC 6749 §2.3.1) — credentials in the
+ form body.
+ - "private_key_jwt" (OIDC Core §9) — a signed client-assertion JWT
+ authenticated by a certificate referenced via CertID; no shared
+ secret.
+Empty string defaults to client_secret_basic.
-**Field: `enabled` (`boolean`)**
-Enabled toggles scope enforcement for this scheme.
+**Field: `clientId` (`string`)**
+ClientID is the OAuth2 client identifier Tyk presents to the IdP token endpoint.
-**Field: `claimNames` (`[]string`)**
-ClaimNames is the ordered list of JWT claim names to read scopes from. Tyk reads all listed claims present on the token and merges the results. Defaults to `["scope", "scp"]` when empty.
+**Field: `clientSecret` (`string`)**
+ClientSecret accepts env://, secrets://, vault://, consul:// prefixes.
-**Field: `separator` (`string`)**
-Separator splits string-valued scope claims into individual scopes. Defaults to `" "` (space, per RFC 6749 §3.3). Set to `","` for comma-separated IdPs.
+**Field: `certId` (`string`)**
+CertID references a certificate (with private key) in the gateway
+certificate store used to sign the private_key_jwt client assertion.
+Required when Method is private_key_jwt; ignored otherwise.
-**Field: `scopeSource` (`string`)**
-ScopeSource selects which `security:` declarations drive enforcement: `"union"` (default — per-operation ∪ root), `"operation"` (per-operation only), or `"global"` (root only).
+### **OAuth2DefaultTarget**
----
+OAuth2DefaultTarget is the fallback audience and scopes when no per-op override is set.
-### **OAuth2ProtectedResourceMetadata**
+**Field: `audience` (`string`)**
+Audience is the default target audience requested for the exchanged token.
-OAuth2ProtectedResourceMetadata configures the RFC 9728 Protected Resource Metadata document served for a per-scheme `oauth2` block. Replaces the deprecated top-level `authentication.protectedResourceMetadata`.
+**Field: `scopes` (`[]string`)**
+Scopes is the default set of scopes requested for the exchanged token.
-**Field: `enabled` (`boolean`)**
-Enabled activates PRM document publishing for this scheme.
+### **OAuth2Exchange**
-**Field: `wellKnownPath` (`string`)**
-WellKnownPath is the path at which the document is served, relative to the API listen path. Defaults to `.well-known/oauth-protected-resource`.
+OAuth2Exchange is the per-operation audience/scopes override for token exchange.
-**Field: `resource` (`string`)**
-Resource is the canonical identifier for this resource, surfaced as `resource` in the PRM document. Accepts Tyk context variables. Required for static mode.
+Scope resolution (most-specific wins):
+ 1. Enabled=true, Scopes non-empty — explicit per-op list.
+ 2. Enabled=true, Scopes empty — inferred from the operation's security: requirement (RFC 8693 §4.5.5).
+ 3. provider.DefaultTarget — used when no per-op block is active (Enabled nil or false).
-**Field: `authorizationServers` (`[]string`)**
-AuthorizationServers is the list of issuer URLs published in the PRM document.
+**Field: `enabled` (`boolean`)**
+Enabled activates this per-operation override; nil or false falls back to
+the provider's DefaultTarget.
-**Field: `autoDeriveScopes` (`boolean`)**
-AutoDeriveScopes unions `scopes_supported` with scopes from every `security:` array when `true` (default). Set to `false` to advertise only the `flows` scopes catalog.
+**Field: `audience` (`string`)**
+Audience is the target audience requested for this operation's exchanged token.
----
+**Field: `scopes` (`[]string`)**
+Scopes is the explicit scope list for this operation; when empty the scopes
+are inferred from the operation's security: requirement (RFC 8693 §4.5.5).
-### **OAuth2TokenExchange**
+### **OAuth2ExchangeCache**
-OAuth2TokenExchange holds RFC 8693 token exchange configuration. Enterprise Edition only — OSS deployments can configure this block but exchange does not execute at runtime.
+OAuth2ExchangeCache controls caching of exchanged tokens per provider.
**Field: `enabled` (`boolean`)**
-Enabled is the master switch for token exchange on this scheme.
+Enabled turns on Redis-backed caching of exchanged tokens for this provider.
-**Field: `providers` (`[]`[OAuth2ExchangeProvider](#oauth2exchangeprovider))**
-Providers is the list of IdP entries this scheme can exchange against. Provider selection is by inbound `iss` claim match against each provider's `issuers` list. Must not be empty when `enabled` is `true`.
+**Field: `mode` (`string`)**
+Mode selects how the cache TTL is derived: "derived" (from the exchanged
+token's expiry) or "static" (the fixed Timeout). Defaults to derived.
----
+**Field: `maxTimeout` (`string`)**
+MaxTimeout caps the TTL in derived mode (e.g. "5m").
-### **OAuth2ExchangeProvider**
+**Field: `timeout` (`string`)**
+Timeout is the fixed cache TTL in static mode (e.g. "2m").
-OAuth2ExchangeProvider configures one IdP entry for token exchange. Provider names must be unique; issuer values must not overlap across providers.
+**Field: `safetyMargin` (`string`)**
+SafetyMargin is shaved from the computed TTL to avoid serving near-expired
+tokens. Defaults to 30s.
-**Field: `name` (`string`)**
-Name is an operator-assigned identifier used in log output. Must be unique within `providers`.
+### **OAuth2PRM**
-**Field: `issuers` (`[]string`)**
-Issuers is the set of inbound token `iss` values routed to this provider. Must not overlap with issuers on other providers.
+OAuth2PRM configures the RFC 9728 Protected Resource Metadata
+document served for a new-style oauth2 security scheme — the static
+counterpart to the deprecated top-level
+authentication.protectedResourceMetadata block (mirror mode stays on
+the old block). See OAuth2PRMScopesSupported for how the served
+scopes_supported list is assembled.
-**Field: `tokenEndpoint` (`string`)**
-TokenEndpoint is the IdP token endpoint. Must accept `grant_type=urn:ietf:params:oauth:grant-type:token-exchange`.
+**Field: `enabled` (`boolean`)**
+Enabled activates publishing of the PRM document.
-**Field: `clientAuth` ([OAuth2ClientAuth](#oauth2clientauth))**
-ClientAuth describes how Tyk authenticates to the token endpoint.
+**Field: `wellKnownPath` (`string`)**
+WellKnownPath is the path under the API listen path at which the
+document is served. Defaults to DefaultPRMWellKnownPath when empty.
-**Field: `defaultTarget` ([OAuth2DefaultTarget](#oauth2defaulttarget))**
-DefaultTarget is the fallback audience and scopes used when the matched operation has no per-operation exchange override.
+**Field: `resource` (`string`)**
+Resource is the canonical resource identifier this gateway
+protects. Surfaced as the `resource` field of the PRM document.
+May contain Tyk context variables, resolved at request time.
-**Field: `timeout` ([ReadableDuration](#readableduration))**
-Timeout caps each call to `tokenEndpoint`. Defaults to `"15s"`.
+**Field: `authorizationServers` (`[]string`)**
+AuthorizationServers is the list of issuer URLs published in the
+PRM document. Clients use these to discover where to obtain a
+token. At least one entry is required for MCP-proxy APIs.
-**Field: `customParams` (`map[string]string`)**
-CustomParams are extra form parameters appended to the exchange request. Standard RFC 8693 keys are reserved and may not be overridden.
+**Field: `autoDeriveScopes` (`boolean`)**
+AutoDeriveScopes unions the served scopes_supported with scopes from
+every `security:` array when nil or true (default); false advertises
+only the `flows..scopes` catalog. See OAuth2PRMScopesSupported.
-**Field: `cache` ([OAuth2ExchangeCache](#oauth2exchangecache))**
-Cache controls Redis-backed caching of exchanged tokens for this provider.
+### **OAuth2ScopeCheck**
----
+OAuth2ScopeCheck holds OAS-native scope enforcement configuration.
-### **OAuth2ClientAuth**
+The required scopes themselves live in the OAS root `security:`
+array (standard OpenAPI). Each entry in `security:` that lists this
+scheme contributes one alternative; the scopes within an entry are
+AND-required; multiple entries are OR. This sub-block carries only
+the token-side knobs (where to read scopes from the JWT, which
+alternatives to read) — it does not redeclare the scope policy.
-OAuth2ClientAuth describes how Tyk authenticates to the IdP token endpoint.
+Tyk supports three enforcement modes via ScopeSource:
-**Field: `method` (`string`)**
-Method selects the client-auth scheme: `"client_secret_basic"` (default — credentials in the `Authorization` header) or `"client_secret_post"` (credentials in the request body).
+ - "union" (default): per-operation `security:` ∪ root `security:`.
+ With per-operation declarations empty, this collapses to the
+ root-only model. With both set, every request must satisfy at
+ least one alternative drawn from the combined set.
+ - "operation": only the matched OAS operation's `security:` array
+ drives the required-scope set; root `security:` is ignored.
+ - "global": only the OAS root `security:` array applies, uniformly
+ to every request on this API.
-**Field: `clientId` (`string`)**
-ClientID is the OAuth 2.0 client identifier Tyk presents to the IdP.
+**Field: `enabled` (`boolean`)**
+Enabled toggles scope enforcement for this scheme. When false the
+scope-check sub-block is inert and the oauth2 scheme is treated as
+authentication-only.
-**Field: `clientSecret` (`string`)**
-ClientSecret accepts `env://`, `secrets://`, `vault://`, `consul://` prefixes.
+**Field: `claimNames` (`[]string`)**
+ClaimNames is the ordered list of JWT claim names to read scopes
+from. The gateway reads the value of every listed claim that is
+present on the token, parses each value into individual scopes
+(per Separator / JSON-array / comma-separated rules), and
+**merges** the results into one normalized scope set. The
+alternatives drawn from OAS `security:` are checked against the
+merged set — a scope is considered present if it appears in any
+listed claim.
+
+When ClaimNames is empty the gateway uses the default
+`["scope", "scp"]` so OAuth and OIDC tokens are both honored
+without operator config. There is no singular ClaimName field —
+callers always express the source as a list, even when it has
+one entry.
----
+**Field: `separator` (`string`)**
+Separator splits the claim's string value into individual
+scopes. Defaults to a single space (RFC 6749 §3.3). Set to ","
+for comma-separated IdPs.
-### **OAuth2DefaultTarget**
+**Field: `scopeSource` (`string`)**
+ScopeSource selects whether enforcement reads from per-operation
+`security:`, the OAS root `security:`, or both. Defaults to
+"union".
-OAuth2DefaultTarget is the fallback audience and scopes used when no per-operation exchange override is set.
+### **OAuth2TokenExchange**
-**Field: `audience` (`string`)**
-Audience is the default target audience requested for the exchanged token.
+OAuth2TokenExchange holds RFC 8693 token exchange configuration for
+this scheme. When Enabled, the gateway dispatches inbound tokens to
+one of the configured providers based on the inbound `iss` claim and
+posts an RFC 8693 token-exchange request to that provider's
+tokenEndpoint. The exchanged token replaces the Authorization header
+on the request before it is forwarded upstream.
-**Field: `scopes` (`[]string`)**
-Scopes is the default set of scopes requested for the exchanged token.
+**Field: `enabled` (`boolean`)**
+Enabled is the master switch for token exchange on this scheme.
+When false, the block is inert.
----
+**Field: `providers` ([[]OAuth2TokenExchangeProvider](#oauth2tokenexchangeprovider))**
+Providers is the list of IdP entries this scheme can exchange
+against. Provider selection at request time is by inbound `iss`
+claim match against Providers[i].Issuers — see SelectExchangeProvider
+in internal/oauth2common.
-### **OAuth2ExchangeCache**
+### **OAuth2TokenExchangeProvider**
-OAuth2ExchangeCache controls Redis-backed caching of exchanged tokens per provider.
+OAuth2TokenExchangeProvider configures one IdP entry. Provider selection
+is by inbound `iss` claim match against Issuers; must be unique across Providers.
-**Field: `enabled` (`boolean`)**
-Enabled turns on caching of exchanged tokens for this provider.
+**Field: `name` (`string`)**
+Name is an operator-chosen identifier used in audit logs. Unique within Providers.
-**Field: `mode` (`string`)**
-Mode selects how the cache TTL is derived: `"derived"` (default — from the exchanged token's `exp` claim) or `"static"` (the fixed `timeout` value).
+**Field: `grantType` (`string`)**
+GrantType selects the grant_type this provider's exchange request uses.
+Empty or "token-exchange" (default) sends the RFC 8693 token-exchange
+grant; "jwt-bearer" sends the RFC 7523 jwt-bearer grant with the inbound
+token as `assertion` and the target rendered into `scope`. The default
+keeps existing providers unchanged.
-**Field: `maxTimeout` ([ReadableDuration](#readableduration))**
-MaxTimeout caps the TTL in `"derived"` mode (for example, `"5m"`). Has no effect in `"static"` mode.
+**Field: `issuers` (`[]string`)**
+Issuers is the set of inbound token `iss` values routed to this provider.
+Must not overlap with issuers on other providers — dispatch would be non-deterministic.
-**Field: `timeout` ([ReadableDuration](#readableduration))**
-Timeout is the fixed cache TTL in `"static"` mode (for example, `"2m"`).
+**Field: `tokenEndpoint` (`string`)**
+TokenEndpoint is the IdP token endpoint where Tyk POSTs the
+RFC 8693 exchange request. Must accept
+`grant_type=urn:ietf:params:oauth:grant-type:token-exchange`.
-**Field: `safetyMargin` ([ReadableDuration](#readableduration))**
-SafetyMargin is subtracted from the computed TTL to avoid serving near-expired tokens. Defaults to `"30s"`.
+**Field: `clientAuth` ([OAuth2ClientAuth](#oauth2clientauth))**
+ClientAuth selects how Tyk authenticates as a confidential
+client to the IdP on the exchange call.
----
+**Field: `defaultTarget` ([OAuth2DefaultTarget](#oauth2defaulttarget))**
+DefaultTarget is the fallback target (audience + scopes) used
+when the matched operation has no per-op exchange override.
-### **OAuth2Exchange**
+**Field: `timeout` (`string`)**
+Timeout caps each call to TokenEndpoint. Uses Tyk's ReadableDuration ("5s", "100ms").
+Defaults to 15s when unset.
-OAuth2Exchange is the per-operation or per-MCP-primitive audience and scopes override for token exchange. Configured under `middleware.operations[id].exchange` or `middleware.mcpTools[name].exchange`.
+**Field: `customParams` (`map[string]string`)**
+CustomParams are extra form parameters appended to the exchange request.
+Keys in oauth2ReservedExchangeFormKeys are rejected at API-load time.
+Values accept env://, secrets://, vault://, consul:// prefixes.
-Scope resolution (most-specific wins):
-1. `enabled: true` with non-empty `scopes` — explicit per-operation list.
-2. `enabled: true` with empty `scopes` — scopes inferred from the operation's `security:` declaration (RFC 8693 §4.5.5).
-3. Provider `defaultTarget` — used when this block is absent or `enabled` is `false`.
+**Field: `cache` ([OAuth2ExchangeCache](#oauth2exchangecache))**
+Cache controls Redis-backed caching of exchanged tokens for this provider.
-**Field: `enabled` (`boolean`)**
-Enabled activates this per-operation override. When `false` or absent, the provider's `defaultTarget` is used.
+### **OAuthProvider**
-**Field: `audience` (`string`)**
-Audience is the target audience requested for this operation's exchanged token.
+OAuthProvider holds the configuration for validation and introspection of OAuth tokens.
-**Field: `scopes` (`[]string`)**
-Scopes is the explicit scope list for this operation. When empty and `enabled` is `true`, scopes are inferred from the operation's `security:` declaration.
+**Field: `jwt` ([JWTValidation](#jwtvalidation))**
+JWT configures JWT validation.
----
-### **ScopeCheck**
+Tyk classic API definition: `external_oauth.providers[].jwt`.
-ScopeCheck is the per-operation or per-MCP-primitive toggle for OAuth 2.0 scope enforcement. Configured under `middleware.operations[id].scopeCheck` or `middleware.mcpTools[name].scopeCheck`.
+**Field: `introspection` ([Introspection](#introspection))**
+Introspection configures token introspection.
-**Field: `enabled` (`boolean`)**
-Enabled enforces the operation's scope check when `true`. Set to `false` to exempt the operation from scope enforcement (for example, where scopes are enforced upstream).
----
+Tyk classic API definition: `external_oauth.providers[].introspection`.
### **Operation**
@@ -2905,10 +3208,12 @@ RequestSizeLimit limits the maximum allowed size of the request body in bytes.
RateLimit contains endpoint level rate limit configuration.
**Field: `scopeCheck` ([ScopeCheck](#scopecheck))**
-ScopeCheck overrides the API-level OAuth 2.0 scope enforcement for this operation. Set `enabled: false` to exempt the operation from scope checks.
+ScopeCheck toggles the operation-level OAuth 2.0 scope check.
**Field: `exchange` ([OAuth2Exchange](#oauth2exchange))**
-Exchange overrides the token exchange provider's default target for this operation. Requires token exchange configured at the API level (Enterprise Edition only).
+Exchange overrides the matched OAuth 2.0 token-exchange provider's
+default target for this operation. Read by the EE token-exchange
+middleware; not propagated to the classic apidef (OAS-native field).
### **Path**
@@ -2995,6 +3300,16 @@ Value is the maximum allowed size of the request body in bytes.
Tyk classic API definition: `version_data.versions..extended_paths.size_limits[].size_limit`.
+### **ScopeCheck**
+
+ScopeCheck toggles the operation-level OAuth 2.0 scope check on an
+operation or MCP primitive. Omitted means enforced; the required
+scopes themselves live in the OAS `security:` array.
+
+**Field: `enabled` (`boolean`)**
+Enabled enforces the operation's scope check when true. Set it
+false to exempt the operation (e.g. scopes enforced upstream).
+
### **SecurityScheme**
SecurityScheme defines an Importer interface for security schemes.
@@ -3122,6 +3437,88 @@ Enabled activates Method Transform for the given path and method.
**Field: `toMethod` (`string`)**
ToMethod is the http method value to which the method of an incoming request will be transformed.
+### **TykMCPServer**
+
+TykMCPServer configures a REST-as-MCP proxy's caller-facing primitive view.
+
+**Field: `primitives` ([[]TykMCPServerPrimitive](#tykmcpserverprimitive))**
+Primitives configures proxy-side source selection and metadata overrides.
+
+### **TykMCPServerParameter**
+
+TykMCPServerParameter overrides one derived MCP input argument. Param names
+refer to derived argument names; Name is the caller-facing replacement.
+
+**Field: `param` (`string`)**
+Param identifies the derived MCP argument to override.
+
+**Field: `name` (`string`)**
+Name overrides the MCP-facing argument name.
+
+**Field: `description` (`string`)**
+Description overrides the MCP-facing argument description.
+
+### **TykMCPServerPrimitive**
+
+TykMCPServerPrimitive selects and overrides one source REST primitive in a
+proxy-specific MCP view. If no primitive has allow:true, the proxy exposes
+all source-derived primitives and applies entries here as metadata overrides.
+If any primitive has allow:true, only allow:true primitives are exposed.
+
+**Field: `source` ([TykMCPServerSource](#tykmcpserversource))**
+Source selects the source REST operation for this primitive.
+
+**Field: `name` (`string`)**
+Name overrides the derived MCP-facing tool name.
+
+**Field: `description` (`string`)**
+Description overrides the derived MCP-facing tool description.
+
+**Field: `annotations` ([DerivedToolAnnotations](#derivedtoolannotations))**
+Annotations overrides MCP tool annotations derived from the source operation.
+
+**Field: `parameters` ([[]TykMCPServerParameter](#tykmcpserverparameter))**
+Parameters configures MCP-facing argument names and descriptions.
+
+**Field: `allow` (`boolean`)**
+Allow exposes this primitive when any primitive uses explicit allow mode.
+
+**Field: `inputSchema` (`map[string]any`)**
+InputSchema is populated in expanded responses with the final MCP tool input schema.
+
+**Field: `outputSchema` (`map[string]any`)**
+OutputSchema is populated in expanded responses with the final MCP tool output schema.
+
+**Field: `parameterLocations` (`map[string]string`)**
+ParameterLocations maps final MCP parameter names to their source REST location in expanded responses.
+
+**Field: `parameterSourceNames` (`map[string]string`)**
+ParameterSourceNames maps final MCP parameter names to their original REST names in expanded responses.
+
+**Field: `parameterSerializations` (`map[string]DerivedParamSerialization`)**
+ParameterSerializations describes final path/query/header serialization in expanded responses.
+
+**Field: `parameterOrder` (`[]string`)**
+ParameterOrder preserves final parameter order in expanded responses.
+
+**Field: `requestBodyContentType` (`string`)**
+RequestBodyContentType is populated in expanded responses when the source request body has a selected media type.
+
+### **TykMCPServerSource**
+
+TykMCPServerSource identifies the source REST operation behind an MCP
+primitive. OperationID is preferred; path+method is accepted for source
+operations that do not define operationId.
+
+**Field: `operationId` (`string`)**
+OperationID selects a source REST operation by operationId.
+
+**Field: `path` (`string`)**
+Path selects a source REST operation by OAS path template.
+
+**Field: `method` (`string`)**
+Method selects a source REST operation by HTTP method.
+
### **URLRewrite**
URLRewrite configures URL rewriting.
diff --git a/swagger/dashboard-admin-swagger.yml b/swagger/dashboard-admin-swagger.yml
index d57309b0f6..c9317c926a 100644
--- a/swagger/dashboard-admin-swagger.yml
+++ b/swagger/dashboard-admin-swagger.yml
@@ -20,7 +20,7 @@ info:
name: Mozilla Public License Version 2.0
url: https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md
title: Tyk Dashboard Admin API
- version: 5.13.0
+ version: 5.14.0
servers:
- url: https://{tenant}
variables:
@@ -4346,6 +4346,11 @@ components:
type: integer
global_size_limit_disabled:
type: boolean
+ global_enforce_timeout:
+ type: string
+ example: "5s"
+ global_enforce_timeout_disabled:
+ type: boolean
ignore_endpoint_case:
type: boolean
name:
diff --git a/swagger/dashboard-swagger.yml b/swagger/dashboard-swagger.yml
index d97a0d2720..37172ef582 100644
--- a/swagger/dashboard-swagger.yml
+++ b/swagger/dashboard-swagger.yml
@@ -39,7 +39,7 @@ info:
name: Mozilla Public License Version 2.0
url: https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md
title: Tyk Dashboard API
- version: 5.13.0
+ version: 5.14.0
servers:
- url: https://{tenant}
variables:
@@ -185,6 +185,8 @@ tags:
name: System
- description: Notifications for an organisation
name: Organisation Notifications
+- description: Manage client Identity Providers (IdPs) for API-level JWT authentication.
+ name: Client IdPs
paths:
/api/activity/keys/{keyHash}/{startDay}/{startMonth}/{startYear}/{EndDay}/{EndMonth}/{EndYear}:
get:
@@ -567,6 +569,36 @@ paths:
required: false
schema:
type: string
+ - description: Comma separated list of gateway segment tags to filter APIs by.
+ example: us-east,eu-west
+ in: query
+ name: tags
+ required: false
+ schema:
+ type: string
+ - description: Filter APIs by their governance compliance status.
+ example: compliant
+ in: query
+ name: compliance_status
+ required: false
+ schema:
+ enum:
+ - compliant
+ - non_compliant
+ - in_process
+ - not_evaluated
+ type: string
+ - description: >-
+ When true, the response includes a top-level `stats` object with aggregate
+ governance compliance counts over the full filtered set. Omit or set to false
+ for the standard response (backward compatible). Has no effect when governance
+ is disabled.
+ example: true
+ in: query
+ name: include_stats
+ required: false
+ schema:
+ type: boolean
- allowEmptyValue: true
description: For versioned APIs, return only the base versions.If any value
is sent in this query parameter only the base version will be returned
@@ -4115,7 +4147,18 @@ paths:
validated against the MCP JSON schema and rejected if it uses any restricted
middleware (transformRequestMethod, transformResponseBody, urlRewrite,
internal, cache, validateRequest, mockResponse).
+
+ When `dryRun=true`, the definition is validated and returned without being
+ persisted. When `expand=true` is also supplied for an internal
+ REST-as-MCP proxy target such as `tyk://orders-rest/mcp`, the response
+ includes the full derived `x-tyk-mcp-server.primitives` catalogue with
+ selected tools marked `allow: true` and unselected tools marked
+ `allow: false`. `expand=true` has no effect for remote MCP proxy
+ upstreams.
operationId: addMCPAPI
+ parameters:
+ - { in: query, name: dryRun, required: false, schema: { type: boolean, default: false }, description: Validate and render the MCP Proxy definition without persisting it. }
+ - { in: query, name: expand, required: false, schema: { type: boolean, default: false }, description: Expand an internal REST-as-MCP proxy response with the full configurable tool catalogue. }
requestBody:
required: true
content:
@@ -4153,8 +4196,13 @@ paths:
content:
application/json:
example: { Status: OK, Message: MCP Proxy definition created, ID: e30bee13ad4248c3b529a4c58bb7be4e }
- schema: { $ref: '#/components/schemas/ApiResponse' }
- description: MCP Proxy definition created.
+ schema:
+ oneOf:
+ - { $ref: '#/components/schemas/ApiResponse' }
+ - allOf:
+ - $ref: '#/components/schemas/OpenAPI3Schema'
+ - $ref: '#/components/schemas/TykVendorExtension'
+ description: MCP Proxy definition created, or validated dry-run OAS returned.
"400":
content:
application/json:
@@ -4170,8 +4218,15 @@ paths:
- { in: path, name: apiId, required: true, schema: { type: string }, description: MCP Proxy definition ID. }
get:
description: Retrieve a single MCP Proxy definition by its ID. Returns 400 if
- the ID refers to a definition that is not an MCP Proxy definition.
+ the ID refers to a definition that is not an MCP Proxy definition. When
+ `expand=true` is supplied for an internal REST-as-MCP proxy target, the
+ response includes the full derived `x-tyk-mcp-server.primitives`
+ catalogue with selected and unselected tools marked by `allow`. Normal
+ reads return the stored definition exactly. `expand=true` has no effect
+ for remote MCP proxy upstreams.
operationId: getMCPAPI
+ parameters:
+ - { in: query, name: expand, required: false, schema: { type: boolean, default: false }, description: Expand an internal REST-as-MCP proxy response with the full configurable tool catalogue. }
responses:
"200":
content:
@@ -10028,217 +10083,1254 @@ paths:
summary: Search user with email.
tags:
- Users
- /api/audit-logs:
- get:
- description: Retrieve audit logs from database
- operationId: getAuditLogs
- parameters:
- - description: Use p query parameter to say which page you want returned. The size of the page is determined by the configuration option page_size of dashboard.
- example: 1
- in: query
- name: p
- required: false
- schema:
- type: integer
- - description: Filters audit logs to show only actions performed by the specified user. This parameter allows you to focus on the activity of a particular user across the system.
- example: jhon@mail.com
- in: query
- name: user
- required: false
- schema:
- type: string
- - description: Filters audit logs based on the specific action performed by users. This parameter allows you to focus on particular types of activities within the system.
- example: List APIs
- in: query
- name: action
- required: false
- schema:
- type: string
- - description: Filters audit logs based on the IP address from which the action originated. This parameter allows you to focus on activities from specific network locations or to investigate actions from particular IP addresses.
- example: 127.0.0.1
- in: query
- name: ip
- required: false
- schema:
- type: string
- - description: Filters audit logs based on the HTTP method used in the API request. This parameter allows you to focus on specific types of operations performed on the API.
- example: POST
- in: query
- name: method
- required: false
- schema:
- type: string
- - description: Filters audit logs based on the HTTP status code returned by the API in response to the request. This parameter allows you to focus on specific outcomes of API interactions.
- example: 200
- in: query
- name: status
- required: false
- schema:
- type: integer
- - description: |
- This parameter filters audit logs based on partially matching the accessed API endpoint's URL path. It allows searching for actions performed on related resources or sections of the API by matching any portion of the URL. The match is case-sensitive and ignores additional path segments or query parameters beyond the matched portion.
- For example, if the database contains URLs like `/tib/create`, `/tib/get/1?schema=json`, `/api/schema`, and `/schema1` searching with `url=schema` would return `/api/schema` and `/schema1`.
- example: /api/apis
- in: query
- name: url
- required: false
- schema:
- type: string
- - description: Specifies the start date for the audit log search. If not provided, the search will include records from the earliest available date. Format YYYY-MM-DD.
- example: 1990-11-25
- in: query
- name: from_date
- required: false
- schema:
- type: string
- - description: Specifies the end date for the audit log search. If not provided, the search will include records up to the current date and time. Format YYYY-MM-DD.
- example: 2030-12-18
- in: query
- name: to_date
- required: false
- schema:
- type: string
- - description: Determines whether the response should be a downloadable file containing the records. If set to `true`, the API returns a file instead of a JSON list of records. When enabled, pagination is not applied, and the file will include all records that match the search criteria.
- example: true
- in: query
- name: download
- required: false
- schema:
- type: boolean
- - description: Specifies the format of the downloadable file. This parameter is only applied when `download` is set to `true`. If set to `csv`, the file content will be in CSV format; otherwise, JSON format will be used.
- in: query
- name: type
- required: false
- schema:
- type: string
- enum: [ csv, json ]
- example: csv
+ /api/evaluations/sandbox:
+ post:
+ summary: Run a sandbox evaluation against saved rulesets and saved APIs.
+ description: >
+ Synchronously evaluate one or more **saved** APIs against a selected
+ set of rulesets and return the violations inline. No persistence.
+ Used by the Ruleset Test Sandbox UI ("Test ruleset" on the ruleset
+ detail screen and the API Governance Tab).
+
+
+ Rulesets are selected via either `ruleset_ids` (explicit) or
+ `categories` (executes every active ruleset whose categories
+ intersect the input) — exactly one of the two. APIs are selected via
+ `api_ids` (required). This endpoint takes references only — to
+ evaluate an API definition submitted in the request (CI/CD file, UI
+ draft), use `POST /api/evaluations/sandbox/oas`. Caps: 10 APIs,
+ 20 resolved rulesets, 20 input categories, 1,000 issues per response.
+ operationId: sandboxEvaluation
+ tags:
+ - Evaluations
+ requestBody:
+ required: true
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/SandboxEvaluationRequest'
+ examples:
+ saved-ruleset-saved-api:
+ summary: UI sandbox — saved ruleset, saved API (Governance Tab "Test ruleset")
+ value:
+ ruleset_ids: ["rs-payments-v1"]
+ api_ids: ["petstore"]
+ by-category-saved-api:
+ summary: UI sandbox — run all rulesets in a category against this API
+ value:
+ categories: ["payments", "internal"]
+ api_ids: ["petstore"]
responses:
"200":
+ description: >
+ Evaluation completed. The response may include a non-empty `error`
+ string when the engine returned failures for some
+ `(ruleset, api)` pairs while others succeeded; successful pairs'
+ issues are still present in `issues`. An empty `rulesets[]`
+ indicates no rulesets matched (category resolution returned none,
+ or all matching rulesets had a different `resource_type` than the
+ APIs).
content:
- application/octet-stream:
- schema:
- type: string
- format: binary
- description: A file containing the audit logs in either JSON or CSV format, depending on the `type` query parameter.
application/json:
- example:
- pages: 1
- audit_logs:
- - _id: 672a83e2b0418b224440ce29
- req_id: 0462e283-a55f-41ab-6482-60d2eeb1858c
- org_id: 66cf7f8db0418b1fbe91852b
- date: Tue, 05 Nov 2024 17:45:22 -03
- timestamp: 1730839522
- ip: 127.0.0.1
- user: jhon@mail.com
- action: ''
- method: GET
- url: "/api/audit-logs"
- status: 200
- - _id: 672a83e9b0418b224440ce2a
- req_id: 1276517a-a57e-4b20-5cf5-a6d830fc399d
- org_id: 66cf7f8db0418b1fbe91852b
- date: Tue, 05 Nov 2024 17:45:29 -03
- timestamp: 1730839529
- ip: 127.0.0.1
- user: jhon@mail.com
- action: ''
- method: GET
- url: "/api/audit-logs"
- status: 200
- - _id: 672a83ecb0418b224440ce2b
- req_id: 9c720384-2c93-4c38-7164-35b876fd56ef
- org_id: 66cf7f8db0418b1fbe91852b
- date: Tue, 05 Nov 2024 17:45:32 -03
- timestamp: 1730839532
- ip: 127.0.0.1
- user: jhon@mail.com
- action: ''
- method: GET
- url: "/api/audit-logs"
- status: 200
schema:
- $ref: '#/components/schemas/AuditLogs'
- description: Audit Logs retrieved successfully
+ $ref: '#/components/schemas/SandboxEvaluationResponse'
"400":
+ description: >
+ Validation failed: both or neither of `ruleset_ids` /
+ `categories` set, `api_ids` missing or empty, removed `apis`
+ field present (use `/api/evaluations/sandbox/oas`), classic API
+ in set, batch over caps (`MaxSandboxAPIs`, `MaxSandboxRulesets`,
+ `MaxSandboxCategories`), or invalid ruleset definition
+ (whole-call engine transform error).
content:
application/json:
- example:
- Message: could not retrieve audit records
- Meta: null
- Status: Error
- description: Bad Request
+ schema: {$ref: '#/components/schemas/ApiResponse'}
"401":
+ description: Unauthorized.
content:
application/json:
- example:
- Message: Not authorised
- Meta: null
- Status: Error
- description: Unauthorized
+ schema: {$ref: '#/components/schemas/ApiResponse'}
"403":
+ description: Forbidden — governance is disabled at deployment level (license / config feature flag), the user lacks the APIs permission, or (with API ownership enabled) a requested api_id is not owned by the caller. Sandbox evaluations are read-only previews, so `apis:read` is sufficient; `apis:deny` or a permissions map without an `apis` entry is rejected.
content:
application/json:
- example:
- Message: 'access denied: You do not have permission to access /api/audit-logs'
- Meta: null
- Status: Error
- description: Forbidden
- summary: List audit logs
+ schema: {$ref: '#/components/schemas/ApiResponse'}
+ "404":
+ description: Any `ruleset_ids` or `api_ids` entry not found within the org.
+ content:
+ application/json:
+ schema: {$ref: '#/components/schemas/ApiResponse'}
+ "500":
+ description: Internal server error.
+ content:
+ application/json:
+ schema: {$ref: '#/components/schemas/ApiResponse'}
+
+ /api/evaluations/sandbox/oas:
+ post:
+ summary: Run a sandbox evaluation for one submitted OAS definition.
+ description: >
+ Synchronously evaluate one OpenAPI/Tyk OAS API definition submitted
+ as content — either the raw file as the request body
+ (`--data-binary @openapi.yaml`) or a `{"content": "..."}` JSON
+ envelope. The definition is treated as a transient inline API:
+ no import, no persistence. Used by CI/CD pipelines (API token) and
+ the UI draft-OAS flow (session + CSRF).
+
+
+ Shape detection is deterministic: a JSON body whose top-level object
+ has a `content` key is an envelope (no valid OpenAPI document has
+ one); everything else is a raw document. The envelope's `content`
+ string is parsed as JSON first, then YAML.
+
+
+ Ruleset selection is explicit and bounded: `ruleset_ids`, else
+ `categories`, else `400`. Categories are never derived from the
+ submitted file — OAS documents carry no category linkage (for OAS
+ APIs, categories live on the Dashboard-stored API envelope, not in
+ the definition). There is **no** "run all active rulesets" fallback
+ — CI behavior must not change because an unrelated ruleset became
+ active.
+ operationId: sandboxEvaluationOAS
tags:
- - AuditLogs
- /api/audit-logs/{audit-log-id}:
- get:
- description: Retrieve a single audit log from database by ID
- operationId: getAuditLog
+ - Evaluations
parameters:
- - description: ID of the audit log record to fetch.
- example: 1
- in: path
- name: audit-log-id
- required: true
+ - in: query
+ name: ruleset_ids
+ required: false
schema:
- type: integer
+ type: array
+ maxItems: 20
+ items: {type: string}
+ style: form
+ explode: false
+ description: >
+ Saved ruleset IDs, comma-separated (repeated params also
+ accepted by the handler). When set, overrides category-based
+ resolution. Inactive rulesets are accepted when selected
+ explicitly. Mutually exclusive with `categories`.
+ - in: query
+ name: categories
+ required: false
+ schema:
+ type: array
+ maxItems: 10
+ items: {type: string}
+ style: form
+ explode: false
+ description: >
+ Governance categories, comma-separated (repeated params also
+ accepted by the handler). Resolves to active `oas-api` rulesets.
+ The only category source for this endpoint — the submitted file
+ carries none. Mutually exclusive with `ruleset_ids`.
+ - in: query
+ name: api_id
+ required: false
+ schema: {type: string}
+ description: >
+ Optional transient API ID echoed on response rows and used in
+ issue IDs. Recommended for CI: if omitted, the fallback is
+ `x-tyk-api-gateway.info.id`, then a deterministic hash of the
+ canonicalized parsed document — which changes on every spec
+ edit, churning issue IDs between commits.
+ - in: query
+ name: api_name
+ required: false
+ schema: {type: string}
+ description: >
+ Optional display name for the submitted document (engine-internal
+ identity; response rows identify the API by `api_id` only).
+ Defaults to `x-tyk-api-gateway.info.name`, then `info.title`,
+ then `api_id`.
+ requestBody:
+ required: true
+ content:
+ application/json:
+ schema:
+ oneOf:
+ - $ref: '#/components/schemas/SandboxContentRequest'
+ - $ref: '#/components/schemas/TykOasApiDefinition'
+ examples:
+ raw-oas-json:
+ summary: Raw mode — checked-in OpenAPI JSON file as the request body
+ value:
+ openapi: "3.0.3"
+ info: {title: "Checkout API", version: "1.2.3"}
+ paths: {}
+ envelope-yaml:
+ summary: Envelope mode — YAML definition wrapped as a JSON string
+ value:
+ content: "openapi: 3.0.3\ninfo:\n title: Checkout API\n version: 1.2.3\npaths: {}\n"
+ application/yaml:
+ schema:
+ $ref: '#/components/schemas/TykOasApiDefinition'
+ examples:
+ raw-oas-yaml:
+ summary: Raw mode — checked-in OpenAPI YAML file as the request body
+ value:
+ openapi: "3.0.3"
+ info: {title: "Checkout API", version: "1.2.3"}
+ paths: {}
+ application/x-yaml:
+ schema:
+ $ref: '#/components/schemas/TykOasApiDefinition'
responses:
"200":
+ description: >
+ Evaluation completed. `evaluated_apis` is always 1 on this
+ endpoint. The response may include a non-empty `error` string
+ for partial engine failures. CI gates must inspect the body —
+ `truncated == true`, a present `error`, or blocking-severity
+ issues all arrive with HTTP 200.
content:
application/json:
- example:
- _id: 672a83e2b0418b224440ce29
- req_id: 0462e283-a55f-41ab-6482-60d2eeb1858c
- org_id: 66cf7f8db0418b1fbe91852b
- date: Tue, 05 Nov 2024 17:45:22 -03
- timestamp: 1730839522
- ip: 127.0.0.1
- user: jhon@mail.com
- action: ''
- method: GET
- url: "/api/audit-logs"
- status: 200
schema:
- $ref: '#/components/schemas/AuditLog'
- description: Audit Log retrieved successfully
+ $ref: '#/components/schemas/SandboxEvaluationResponse'
"400":
+ description: >
+ Validation failed: empty body, unsupported Content-Type, body
+ not valid JSON/YAML, document not a valid OpenAPI/Tyk OAS
+ definition, envelope `content` missing / not a string /
+ accompanied by other fields, both `ruleset_ids` and `categories`
+ set, no resolvable ruleset scope, over caps
+ (`MaxSandboxRulesets`, `MaxSandboxCategories`), or invalid
+ ruleset definition (whole-call engine transform error).
content:
application/json:
- example:
- Message: could not retrieve audit record
- Meta: null
- Status: Error
- description: Bad Request
+ schema: {$ref: '#/components/schemas/ApiResponse'}
"401":
+ description: Unauthorized.
content:
application/json:
- example:
- Message: Not authorised
- Meta: null
- Status: Error
- description: Unauthorized
+ schema: {$ref: '#/components/schemas/ApiResponse'}
"403":
+ description: Forbidden — governance is disabled at deployment level (license / config feature flag), the user lacks the APIs permission, or (with API ownership enabled) a requested api_id is not owned by the caller. Sandbox evaluations are read-only previews, so `apis:read` is sufficient; `apis:deny` or a permissions map without an `apis` entry is rejected.
content:
application/json:
- example:
+ schema: {$ref: '#/components/schemas/ApiResponse'}
+ "404":
+ description: Any explicit `ruleset_ids` entry not found within the org or soft-deleted.
+ content:
+ application/json:
+ schema: {$ref: '#/components/schemas/ApiResponse'}
+ "413":
+ description: Request body exceeds the Dashboard's max request size.
+ content:
+ application/json:
+ schema: {$ref: '#/components/schemas/ApiResponse'}
+ "500":
+ description: Internal server error.
+ content:
+ application/json:
+ schema: {$ref: '#/components/schemas/ApiResponse'}
+
+ /api/rulesets:
+ get:
+ summary: List rulesets.
+ description: >
+ Return a paginated list of rulesets within the caller's org.
+ Supports filtering by `q` (case-insensitive name substring), `active`, `is_template`,
+ `categories`, `resource_type`, and sorting via `sort` (prefix `-` for descending).
+
+ By default, templates (admin-seeded fixtures) are excluded from the response.
+ Pass `?is_template=true` to fetch templates only, or `?is_template=false` to
+ explicitly request non-templates (same as the default).
+ operationId: listRulesets
+ tags:
+ - Rulesets
+ parameters:
+ - in: query
+ name: p
+ schema:
+ type: integer
+ description: Page number. Send -1 to return all results.
+ - in: query
+ name: q
+ schema:
+ type: string
+ description: Case-insensitive substring filter on `name`.
+ - in: query
+ name: active
+ schema:
+ type: boolean
+ description: Filter by active status. Omit to return rulesets regardless of active state.
+ - in: query
+ name: is_template
+ schema:
+ type: boolean
+ description: >
+ Filter by template flag. When omitted, templates are excluded by default.
+ Pass `true` to fetch templates only, or `false` to explicitly request non-templates.
+ - in: query
+ name: categories
+ schema:
+ type: string
+ description: Filter rulesets that contain this category.
+ - in: query
+ name: resource_type
+ schema:
+ type: string
+ enum: [oas-api, mcp-api]
+ description: Filter by resource type. One of `oas-api` or `mcp-api`.
+ - in: query
+ name: sort
+ schema:
+ type: string
+ example: "-last_updated"
+ description: >
+ Sort field; prefix `-` for descending.
+ Sortable fields: `name`, `date_created`, `last_updated`. Default: `-last_updated`.
+ Unknown fields fall back to the default rather than erroring.
+ responses:
+ "200":
+ description: Rulesets fetched.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/RulesetList'
+ "400":
+ description: Invalid query parameter.
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "500":
+ description: Internal server error.
+ post:
+ summary: Create a ruleset.
+ description: >
+ Create a new ruleset. `name` is required.
+ `action` defaults to `none`, `resource_type` defaults to `oas-api`.
+ Accepts `application/json` or `multipart/form-data` (parts: `metadata`, `ruleset`).
+ operationId: createRuleset
+ tags:
+ - Rulesets
+ requestBody:
+ required: true
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/RulesetRequest'
+ example:
+ name: "OAS API Ruleset"
+ description: "Validates OAS APIs for compliance"
+ active: true
+ resource_type: "oas-api"
+ action: "warn"
+ categories: ["payments", "internal"]
+ definition: '{"rules":{"operation-tag-defined":{"severity":"warn","given":"$.paths.*.*","then":{"function":"enumeration","functionOptions":{"values":["payments","internal"]}}}}}'
+ responses:
+ "201":
+ description: Ruleset created.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ example:
+ Message: ruleset created
+ Meta: "6644b38535715ec496cbef3d"
+ Status: success
+ "400":
+ description: >
+ Validation failed — missing name, missing definition, invalid definition,
+ unknown action or resource_type, or one or more categories not found
+ in the org's API categories (the error message names the unknown values).
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ "401":
+ description: Unauthorized.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ "403":
+ description: Forbidden — requires write or admin on governance group.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ "409":
+ description: A ruleset with this name already exists within the org.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ "500":
+ description: Internal server error.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+
+ /api/rulesets/{id}:
+ get:
+ summary: Fetch a single ruleset.
+ description: >
+ Look up a ruleset by id within the caller's org.
+ `id` may be either the MongoDB ObjectId hex or the custom `ruleset_id` string —
+ the server tries `ruleset_id` first (so a custom id that happens to be 24 hex
+ characters resolves correctly), and falls back to `_id` only when stage 1 misses.
+ Soft-deleted rulesets and rulesets belonging to other orgs return 404.
+ operationId: getRuleset
+ tags:
+ - Rulesets
+ parameters:
+ - in: path
+ name: id
+ required: true
+ schema:
+ type: string
+ description: ObjectId hex or custom ruleset_id.
+ responses:
+ "200":
+ description: Ruleset fetched.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/RulesetDetail'
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "404":
+ description: Ruleset not found, or not in caller's org.
+ "500":
+ description: Internal server error.
+ put:
+ summary: Update a ruleset.
+ description: >
+ Update an existing ruleset. `RulesetID` is never changed by an update.
+ `action` and `resource_type` fall back to their existing values when omitted.
+ Accepts `application/json` or `multipart/form-data` (individual fields: `name`,
+ `description`, `active`, `action`, `resource_type`, `ruleset_id`, `categories`;
+ optional file field: `ruleset` for the Spectral definition).
+ operationId: updateRuleset
+ tags:
+ - Rulesets
+ parameters:
+ - in: path
+ name: id
+ required: true
+ schema:
+ type: string
+ description: ObjectId hex or custom ruleset_id.
+ requestBody:
+ required: true
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/RulesetRequest'
+ example:
+ name: "OAS API Ruleset"
+ description: "Validates OAS APIs for compliance"
+ active: true
+ resource_type: "oas-api"
+ action: "warn"
+ categories: ["payments", "internal"]
+ definition: '{"rules":{"operation-tag-defined":{"severity":"warn","given":"$.paths.*.*","then":{"function":"enumeration","functionOptions":{"values":["payments","internal"]}}}}}'
+ multipart/form-data:
+ schema:
+ $ref: '#/components/schemas/RulesetRequest'
+ responses:
+ "200":
+ description: Ruleset updated.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/Ruleset'
+ "400":
+ description: >
+ Validation failed — missing name, missing definition, invalid definition,
+ unknown action or resource_type, or one or more categories not found
+ in the org's API categories (the error message names the unknown values).
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden — requires write or admin on governance group.
+ "404":
+ description: Ruleset not found.
+ "409":
+ description: A ruleset with this name already exists within the org.
+ "500":
+ description: Internal server error.
+ delete:
+ summary: Delete a ruleset.
+ description: >
+ Soft-delete a ruleset. The document is retained in the database with `deleted_at` set.
+ Accepts both MongoDB ObjectId hex and stable `ruleset_id` string in the path.
+ Soft-deleted rulesets are excluded from Get and List.
+ operationId: deleteRuleset
+ tags:
+ - Rulesets
+ parameters:
+ - in: path
+ name: id
+ required: true
+ schema:
+ type: string
+ description: ObjectId hex or custom ruleset_id.
+ responses:
+ "200":
+ description: Ruleset deleted.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ example:
+ Message: ruleset deleted
+ Meta: null
+ Status: success
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden — requires write or admin on governance group.
+ "404":
+ description: Ruleset not found.
+ "500":
+ description: Internal server error.
+
+ /api/governance/evaluation-details/{apiID}:
+ get:
+ summary: List lint violations for an API.
+ description: >
+ Returns paginated lint violations produced by the async governance evaluator for
+ the given API within the caller's org.
+ Results are sorted by severity (error → warn → info → hint), then by `ruleset_id`.
+ Use `?p=` to paginate; send `-1` to return all results.
+ Optional filters: `ruleset_id` (exact match) and `severity` (one of `error`, `warn`, `info`, `hint`).
+ operationId: listLintViolations
+ tags:
+ - Governance
+ parameters:
+ - in: path
+ name: apiID
+ required: true
+ schema:
+ type: string
+ description: The API ID to fetch violations for.
+ - in: query
+ name: p
+ schema:
+ type: integer
+ description: Page number. Send `-1` to return all results. Defaults to `1`.
+ - in: query
+ name: ruleset_id
+ schema:
+ type: string
+ description: Filter violations to a specific ruleset.
+ - in: query
+ name: severity
+ schema:
+ type: string
+ enum: [error, warn, info, hint]
+ description: Filter violations by severity level.
+ responses:
+ "200":
+ description: Violations fetched.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/LintViolationList'
+ example:
+ violations:
+ - _id: "6644b38535715ec496cbef3d"
+ org_id: "5e4f2c1a3b6d7e8f9a0b1c2d"
+ api_id: "abc123"
+ ruleset_id: "my-ruleset"
+ ruleset_name: "My OAS Ruleset"
+ rule_id: "operation-tags"
+ rule_summary: "Operation must have at least one tag"
+ how_to_fix: "Add a tags field to the operation object"
+ message: "Operation must have at least one tag"
+ severity: "warn"
+ severity_order: 2
+ path: "paths./pets.get"
+ location:
+ start_line: 12
+ start_char: 4
+ end_line: 12
+ end_char: 20
+ created_at: "2024-05-01T12:00:00Z"
+ pages: 3
+ "400":
+ description: Missing or invalid `apiID`, or a non-numeric `p` page parameter.
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "500":
+ description: Internal server error.
+
+ /api/governance/apis/{apiID}/compliance:
+ get:
+ summary: Get compliance status for an API.
+ description: >
+ Returns the overall governance compliance status for the given API and a per-ruleset
+ breakdown. Each ruleset entry includes the evaluation status, compliance verdict,
+ violation counts, and a compliance level score (0–100).
+ The ruleset name is resolved from tyk_rulesets.
+ Detailed violation lists are served separately by
+ GET /api/governance/evaluation-details/{apiID}.
+ Scoped to the caller's org.
+ operationId: getAPIComplianceStats
+ tags:
+ - Governance
+ parameters:
+ - in: path
+ name: apiID
+ required: true
+ schema:
+ type: string
+ description: The API's api_id.
+ responses:
+ "200":
+ description: Compliance stats fetched.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/APIComplianceResult'
+ example:
+ overall_status: "non_compliant"
+ rulesets:
+ - ruleset_id: "my-oas-ruleset"
+ ruleset_name: "OAS API Ruleset"
+ status: "completed"
+ compliance: "non_compliant"
+ evaluated_at: "2026-06-20T10:00:00Z"
+ error_count: 2
+ warn_count: 5
+ info_count: 0
+ hint_count: 1
+ compliance_level: 92
+ - ruleset_id: "security-baseline"
+ ruleset_name: "Security Baseline"
+ status: "in_process"
+ evaluated_at: null
+ error_count: 0
+ warn_count: 0
+ info_count: 0
+ hint_count: 0
+ "400":
+ description: Missing apiID.
+ "401":
+ description: Unauthorized.
+ "403":
+ description: >
+ Forbidden. Governance is disabled at the deployment level
+ (license / config feature flag), or ownership is enforced and the
+ caller is not an owner of an API that exists within their org.
+ "404":
+ description: >
+ The api_id does not resolve to an API within the caller's org —
+ it does not exist or belongs to a different org.
+ "500":
+ description: Internal server error.
+
+ /api/clientidps:
+ get:
+ summary: List client IdPs.
+ description: >
+ Return a paginated list of client IdPs within the caller's org.
+ Use `?p=` to paginate; send `-1` to return all results.
+ operationId: listClientIdPs
+ tags:
+ - Client IdPs
+ parameters:
+ - in: query
+ name: p
+ schema:
+ type: integer
+ description: Page number. Send -1 to return all results.
+ responses:
+ "200":
+ description: Client IdPs fetched.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ClientIdPList'
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "500":
+ description: Internal server error.
+ post:
+ summary: Create a client IdP.
+ description: >
+ Create a new client IdP. `name` and `jwks_uri` are required.
+ `issuer` is optional. If `client_idp_id` is not supplied it defaults to the record's internal ID hex.
+ `org_id` is set server-side from the session and cannot be overridden.
+ operationId: createClientIdP
+ tags:
+ - Client IdPs
+ requestBody:
+ required: true
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ClientIdPRequest'
+ example:
+ name: "My OIDC Provider"
+ issuer: "https://idp.example.com"
+ jwks_uri: "https://idp.example.com/.well-known/jwks.json"
+ api_mappings: {}
+ responses:
+ "201":
+ description: Client IdP created.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ example:
+ Status: success
+ Message: client idp created
+ Meta: "6644b38535715ec496cbef3d"
+ "400":
+ description: Validation failed — `name` or `jwks_uri` missing, or invalid body.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ "401":
+ description: Unauthorized.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ "403":
+ description: Forbidden.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ "409":
+ description: A client IdP with this `client_idp_id` already exists within the org.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ "500":
+ description: Internal server error.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+
+ /api/clientidps/{id}:
+ get:
+ summary: Fetch a single client IdP.
+ description: >
+ Look up a client IdP by id within the caller's org.
+ `id` may be the internal record ID hex or the custom `client_idp_id` string —
+ the server tries `client_idp_id` first, then falls back to `_id`.
+ operationId: getClientIdP
+ tags:
+ - Client IdPs
+ parameters:
+ - in: path
+ name: id
+ required: true
+ schema:
+ type: string
+ description: Internal record ID hex or custom client_idp_id.
+ responses:
+ "200":
+ description: Client IdP fetched.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ClientIdP'
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "404":
+ description: Client IdP not found, or not in caller's org.
+ "500":
+ description: Internal server error.
+ put:
+ summary: Replace a client IdP.
+ description: >
+ Full replacement of an existing client IdP. `name` and `jwks_uri` are required.
+ `client_idp_id` is preserved when absent from the request body but can be changed
+ when explicitly provided (mirroring policy `id` behaviour).
+ `_id` and `org_id` are always preserved from the stored document.
+ operationId: updateClientIdP
+ tags:
+ - Client IdPs
+ parameters:
+ - in: path
+ name: id
+ required: true
+ schema:
+ type: string
+ description: Internal record ID hex or custom client_idp_id.
+ requestBody:
+ required: true
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ClientIdPRequest'
+ responses:
+ "200":
+ description: Client IdP updated.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ClientIdP'
+ "400":
+ description: Validation failed — `name` or `jwks_uri` missing, or invalid body.
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "404":
+ description: Client IdP not found.
+ "409":
+ description: A client IdP with this `client_idp_id` already exists within the org.
+ "500":
+ description: Internal server error.
+ delete:
+ summary: Delete a client IdP.
+ description: Hard-delete a client IdP. A subsequent GET returns 404.
+ operationId: deleteClientIdP
+ tags:
+ - Client IdPs
+ parameters:
+ - in: path
+ name: id
+ required: true
+ schema:
+ type: string
+ description: Internal record ID hex or custom client_idp_id.
+ responses:
+ "200":
+ description: Client IdP deleted.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ example:
+ Status: success
+ Message: client idp deleted
+ Meta: null
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "404":
+ description: Client IdP not found.
+ "500":
+ description: Internal server error.
+
+ /api/clientidps/{id}/mappings:
+ patch:
+ summary: Bulk merge-patch API mappings.
+ description: >
+ RFC 7386 JSON Merge Patch on the `api_mappings` map.
+ RFC 7386 applies recursively at every nesting level — the same null-to-delete,
+ absent-key-untouched rules hold inside `scope_to_policy` as they do at the `api_id` level.
+ The whole merge is one atomic document write, emitting exactly one
+ `NoticeClientIdPChanged` notification regardless of how many keys are touched.
+
+
+ Remove an entire API mapping (null at the `api_id` level):
+
+ ```json
+ { "8ddd91f3cda9453442c477b06c4e2da4": null }
+ ```
+
+
+ Remove a single scope while leaving the rest of the mapping intact
+ (null at the `scope_to_policy` level):
+
+ ```json
+ { "b84fe1a04e5648927971c0557971565c": { "scope_to_policy": { "read": null } } }
+ ```
+
+
+ Upsert a mapping and delete another in one call:
+
+ ```json
+ {
+ "4c1c0d8fc885401053ddac4e39ef676b": { "scope_to_policy": { "read": "665d51505715ec2d76022c87" } },
+ "8ddd91f3cda9453442c477b06c4e2da4": null
+ }
+ ```
+
+
+ **Important:** to remove a scope key you must send it explicitly as `null`.
+ Omitting a key from the patch body leaves it untouched at every level —
+ there is no way to remove a scope by simply not including it.
+ operationId: patchClientIdPMappings
+ tags:
+ - Client IdPs
+ parameters:
+ - in: path
+ name: id
+ required: true
+ schema:
+ type: string
+ description: Internal record ID hex or custom client_idp_id.
+ requestBody:
+ required: true
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/APIMappingsPatch'
+ responses:
+ "200":
+ description: Mappings merged. Returns the full updated client IdP document.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ClientIdP'
+ "400":
+ description: Invalid body.
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "404":
+ description: Client IdP not found.
+ "500":
+ description: Internal server error.
+
+ /api/clientidps/{id}/mappings/{apiId}:
+ get:
+ summary: Get a single API mapping.
+ description: Returns the scope mapping for the given API within the client IdP.
+ operationId: getClientIdPMapping
+ tags:
+ - Client IdPs
+ parameters:
+ - in: path
+ name: id
+ required: true
+ schema:
+ type: string
+ description: Internal record ID hex or custom client_idp_id.
+ - in: path
+ name: apiId
+ required: true
+ schema:
+ type: string
+ description: The API id.
+ responses:
+ "200":
+ description: Mapping fetched.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ScopeMapping'
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "404":
+ description: Client IdP not found, or no mapping for this API.
+ "500":
+ description: Internal server error.
+ put:
+ summary: Upsert an API mapping.
+ description: Creates or replaces the scope mapping for the given API within the client IdP.
+ operationId: upsertClientIdPMapping
+ tags:
+ - Client IdPs
+ parameters:
+ - in: path
+ name: id
+ required: true
+ schema:
+ type: string
+ description: Internal record ID hex or custom client_idp_id.
+ - in: path
+ name: apiId
+ required: true
+ schema:
+ type: string
+ description: The API id to upsert.
+ requestBody:
+ required: true
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ScopeMapping'
+ example:
+ scope_to_policy:
+ read: "665d51505715ec2d76022c87"
+ write: "5e4f2c1a3b6d7e8f9a0b1c2d"
+ responses:
+ "200":
+ description: Mapping upserted. Returns the full updated client IdP document.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ClientIdP'
+ "400":
+ description: Invalid body.
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "404":
+ description: Client IdP not found.
+ "500":
+ description: Internal server error.
+ delete:
+ summary: Delete an API mapping.
+ description: >
+ Removes the scope mapping for the given API. Other mappings on the same IdP are
+ untouched. Returns 404 if the client IdP is not found.
+ operationId: deleteClientIdPMapping
+ tags:
+ - Client IdPs
+ parameters:
+ - in: path
+ name: id
+ required: true
+ schema:
+ type: string
+ description: Internal record ID hex or custom client_idp_id.
+ - in: path
+ name: apiId
+ required: true
+ schema:
+ type: string
+ description: The API id to remove.
+ responses:
+ "200":
+ description: Mapping deleted.
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ example:
+ Status: success
+ Message: client idp mapping deleted
+ Meta: null
+ "401":
+ description: Unauthorized.
+ "403":
+ description: Forbidden.
+ "404":
+ description: Client IdP or mapping not found.
+ "500":
+ description: Internal server error.
+
+ /api/audit-logs:
+ get:
+ description: Retrieve audit logs from database
+ operationId: getAuditLogs
+ parameters:
+ - description: Use p query parameter to say which page you want returned. The size of the page is determined by the configuration option page_size of dashboard.
+ example: 1
+ in: query
+ name: p
+ required: false
+ schema:
+ type: integer
+ - description: Filters audit logs to show only actions performed by the specified user. This parameter allows you to focus on the activity of a particular user across the system.
+ example: jhon@mail.com
+ in: query
+ name: user
+ required: false
+ schema:
+ type: string
+ - description: Filters audit logs based on the specific action performed by users. This parameter allows you to focus on particular types of activities within the system.
+ example: List APIs
+ in: query
+ name: action
+ required: false
+ schema:
+ type: string
+ - description: Filters audit logs based on the IP address from which the action originated. This parameter allows you to focus on activities from specific network locations or to investigate actions from particular IP addresses.
+ example: 127.0.0.1
+ in: query
+ name: ip
+ required: false
+ schema:
+ type: string
+ - description: Filters audit logs based on the HTTP method used in the API request. This parameter allows you to focus on specific types of operations performed on the API.
+ example: POST
+ in: query
+ name: method
+ required: false
+ schema:
+ type: string
+ - description: Filters audit logs based on the HTTP status code returned by the API in response to the request. This parameter allows you to focus on specific outcomes of API interactions.
+ example: 200
+ in: query
+ name: status
+ required: false
+ schema:
+ type: integer
+ - description: |
+ This parameter filters audit logs based on partially matching the accessed API endpoint's URL path. It allows searching for actions performed on related resources or sections of the API by matching any portion of the URL. The match is case-sensitive and ignores additional path segments or query parameters beyond the matched portion.
+ For example, if the database contains URLs like `/tib/create`, `/tib/get/1?schema=json`, `/api/schema`, and `/schema1` searching with `url=schema` would return `/api/schema` and `/schema1`.
+ example: /api/apis
+ in: query
+ name: url
+ required: false
+ schema:
+ type: string
+ - description: Specifies the start date for the audit log search. If not provided, the search will include records from the earliest available date. Format YYYY-MM-DD.
+ example: 1990-11-25
+ in: query
+ name: from_date
+ required: false
+ schema:
+ type: string
+ - description: Specifies the end date for the audit log search. If not provided, the search will include records up to the current date and time. Format YYYY-MM-DD.
+ example: 2030-12-18
+ in: query
+ name: to_date
+ required: false
+ schema:
+ type: string
+ - description: Determines whether the response should be a downloadable file containing the records. If set to `true`, the API returns a file instead of a JSON list of records. When enabled, pagination is not applied, and the file will include all records that match the search criteria.
+ example: true
+ in: query
+ name: download
+ required: false
+ schema:
+ type: boolean
+ - description: Specifies the format of the downloadable file. This parameter is only applied when `download` is set to `true`. If set to `csv`, the file content will be in CSV format; otherwise, JSON format will be used.
+ in: query
+ name: type
+ required: false
+ schema:
+ type: string
+ enum: [ csv, json ]
+ example: csv
+ responses:
+ "200":
+ content:
+ application/octet-stream:
+ schema:
+ type: string
+ format: binary
+ description: A file containing the audit logs in either JSON or CSV format, depending on the `type` query parameter.
+ application/json:
+ example:
+ pages: 1
+ audit_logs:
+ - _id: 672a83e2b0418b224440ce29
+ req_id: 0462e283-a55f-41ab-6482-60d2eeb1858c
+ org_id: 66cf7f8db0418b1fbe91852b
+ date: Tue, 05 Nov 2024 17:45:22 -03
+ timestamp: 1730839522
+ ip: 127.0.0.1
+ user: jhon@mail.com
+ action: ''
+ method: GET
+ url: "/api/audit-logs"
+ status: 200
+ - _id: 672a83e9b0418b224440ce2a
+ req_id: 1276517a-a57e-4b20-5cf5-a6d830fc399d
+ org_id: 66cf7f8db0418b1fbe91852b
+ date: Tue, 05 Nov 2024 17:45:29 -03
+ timestamp: 1730839529
+ ip: 127.0.0.1
+ user: jhon@mail.com
+ action: ''
+ method: GET
+ url: "/api/audit-logs"
+ status: 200
+ - _id: 672a83ecb0418b224440ce2b
+ req_id: 9c720384-2c93-4c38-7164-35b876fd56ef
+ org_id: 66cf7f8db0418b1fbe91852b
+ date: Tue, 05 Nov 2024 17:45:32 -03
+ timestamp: 1730839532
+ ip: 127.0.0.1
+ user: jhon@mail.com
+ action: ''
+ method: GET
+ url: "/api/audit-logs"
+ status: 200
+ schema:
+ $ref: '#/components/schemas/AuditLogs'
+ description: Audit Logs retrieved successfully
+ "400":
+ content:
+ application/json:
+ example:
+ Message: could not retrieve audit records
+ Meta: null
+ Status: Error
+ description: Bad Request
+ "401":
+ content:
+ application/json:
+ example:
+ Message: Not authorised
+ Meta: null
+ Status: Error
+ description: Unauthorized
+ "403":
+ content:
+ application/json:
+ example:
+ Message: 'access denied: You do not have permission to access /api/audit-logs'
+ Meta: null
+ Status: Error
+ description: Forbidden
+ summary: List audit logs
+ tags:
+ - AuditLogs
+ /api/audit-logs/{audit-log-id}:
+ get:
+ description: Retrieve a single audit log from database by ID
+ operationId: getAuditLog
+ parameters:
+ - description: ID of the audit log record to fetch.
+ example: 1
+ in: path
+ name: audit-log-id
+ required: true
+ schema:
+ type: integer
+ responses:
+ "200":
+ content:
+ application/json:
+ example:
+ _id: 672a83e2b0418b224440ce29
+ req_id: 0462e283-a55f-41ab-6482-60d2eeb1858c
+ org_id: 66cf7f8db0418b1fbe91852b
+ date: Tue, 05 Nov 2024 17:45:22 -03
+ timestamp: 1730839522
+ ip: 127.0.0.1
+ user: jhon@mail.com
+ action: ''
+ method: GET
+ url: "/api/audit-logs"
+ status: 200
+ schema:
+ $ref: '#/components/schemas/AuditLog'
+ description: Audit Log retrieved successfully
+ "400":
+ content:
+ application/json:
+ example:
+ Message: could not retrieve audit record
+ Meta: null
+ Status: Error
+ description: Bad Request
+ "401":
+ content:
+ application/json:
+ example:
+ Message: Not authorised
+ Meta: null
+ Status: Error
+ description: Unauthorized
+ "403":
+ content:
+ application/json:
+ example:
Message: 'access denied: You do not have permission to access /api/audit-log'
Meta: null
Status: Error
@@ -10293,6 +11385,18 @@ paths:
cert_id: 683d6e6a954737af2aa8e5c20d545f3211d5a53684114dc8b3ebb2503edf6fabf2e5812425be2fa108f3fb4d
expiry_date: 2025-08-31T08:41:53Z
days_remaining: 17
+ - id: 7c1e5a2b-91f3-44c8-8f2a-64c1de9a5f01
+ created_at: 2025-08-13T11:16:12.194968+02:00
+ org_id: 683d6e6a954737af2aa8e5c2
+ hash: '9931265912947126831'
+ kind: critical
+ topic: governance.compliance
+ title: Governance compliance failure
+ message: API petstore fails governance ruleset rs-secure-access
+ data:
+ api_id: petstore
+ ruleset_id: rs-secure-access
+ status: failure
schema:
type: array
items:
@@ -11256,6 +12360,15 @@ components:
$ref: '#/components/schemas/ApiModel'
categories:
$ref: '#/components/schemas/Categories'
+ compliance_status:
+ description: Governance compliance status derived from evaluation results.
+ Omitted when the governance feature is not enabled or no evaluations have run.
+ enum:
+ - compliant
+ - non_compliant
+ - in_process
+ - not_evaluated
+ type: string
created_at:
format: date-time
nullable: true
@@ -11299,6 +12412,23 @@ components:
type: array
pages:
type: integer
+ stats:
+ $ref: '#/components/schemas/OrgComplianceStats'
+ type: object
+ OrgComplianceStats:
+ description: Aggregate governance compliance counts over the full filtered API set.
+ Present only when include_stats=true and governance is enabled.
+ properties:
+ total_apis:
+ type: integer
+ compliant:
+ type: integer
+ non_compliant:
+ type: integer
+ unassessed:
+ type: integer
+ total_issues:
+ type: integer
type: object
ApiImportByUrlPayload:
properties:
@@ -11775,6 +12905,17 @@ components:
type: integer
type: object
x-go-package: github.com/TykTechnologies/tyk-analytics/dashboard/repository/notification
+ GovernanceComplianceData:
+ properties:
+ api_id:
+ type: string
+ ruleset_id:
+ type: string
+ status:
+ type: string
+ enum: [ "failure" ]
+ type: object
+ x-go-package: github.com/TykTechnologies/tyk-analytics/dashboard/repository/notification
CertificateList:
properties:
certs:
@@ -13461,7 +14602,7 @@ components:
enum: [ "critical", "warning" ]
topic:
type: string
- enum: [ "certificate.expiry" ]
+ enum: [ "certificate.expiry", "governance.compliance" ]
title:
type: string
message:
@@ -13469,6 +14610,7 @@ components:
data:
oneOf:
- $ref: "#/components/schemas/CertificateExpiryData"
+ - $ref: "#/components/schemas/GovernanceComplianceData"
type: object
x-go-package: github.com/TykTechnologies/tyk-analytics/dashboard/model
PathItem:
@@ -14378,834 +15520,1405 @@ components:
- edge
- edge-eu
items:
- type: string
- nullable: true
+ type: string
+ nullable: true
+ type: array
+ throttle_interval:
+ example: 10
+ format: double
+ type: number
+ throttle_retry_limit:
+ example: -1
+ type: integer
+ type: object
+ SignatureConfig:
+ properties:
+ algorithm:
+ type: string
+ allowed_clock_skew:
+ format: int64
+ type: integer
+ error_code:
+ type: integer
+ error_message:
+ type: string
+ header:
+ type: string
+ param_name:
+ type: string
+ secret:
+ type: string
+ use_param:
+ type: boolean
+ type: object
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ State:
+ properties:
+ active:
+ type: boolean
+ internal:
+ type: boolean
+ type: object
+ StringRegexMap:
+ properties:
+ match_rx:
+ type: string
+ reverse:
+ type: boolean
+ type: object
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ SystemStatsResp:
+ properties:
+ message:
+ type: string
+ stats:
+ $ref: '#/components/schemas/EntityStats'
+ status:
+ example: Success
+ type: string
+ type: object
+ Tag:
+ properties:
+ description:
+ type: string
+ externalDocs:
+ $ref: '#/components/schemas/ExternalDocs'
+ name:
+ type: string
+ type: object
+ Tags:
+ items:
+ $ref: '#/components/schemas/Tag'
+ type: array
+ TemplateData:
+ properties:
+ enable_session:
+ type: boolean
+ input_type:
+ type: string
+ template_mode:
+ type: string
+ template_source:
+ type: string
+ type: object
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ TemplateMeta:
+ properties:
+ disabled:
+ type: boolean
+ method:
+ type: string
+ path:
+ type: string
+ template_data:
+ $ref: '#/components/schemas/TemplateData'
+ type: object
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ Test:
+ nullable: true
+ properties:
+ serviceDiscovery:
+ $ref: '#/components/schemas/ServiceDiscovery'
+ type: object
+ TimeDuration:
+ format: duration
+ type: string
+ example: "30s"
+ TimeReadableDuration:
+ format: duration
+ type: string
+ example: PT2H30M15S
+ TrackEndpoint:
+ nullable: true
+ properties:
+ enabled:
+ type: boolean
+ type: object
+ TrackEndpointMeta:
+ properties:
+ disabled:
+ type: boolean
+ method:
+ type: string
+ path:
+ type: string
+ type: object
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ TrafficLogs:
+ nullable: true
+ properties:
+ enabled:
+ type: boolean
+ type: object
+ TransformBody:
+ nullable: true
+ properties:
+ body:
+ type: string
+ enabled:
+ type: boolean
+ format:
+ type: string
+ path:
+ type: string
+ type: object
+ TransformHeaders:
+ nullable: true
+ properties:
+ add:
+ $ref: '#/components/schemas/Headers'
+ enabled:
+ type: boolean
+ remove:
+ items:
+ type: string
+ type: array
+ type: object
+ TransformJQMeta:
+ properties:
+ filter:
+ type: string
+ method:
+ type: string
+ path:
+ type: string
+ type: object
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ TransformRequestMethod:
+ nullable: true
+ properties:
+ enabled:
+ type: boolean
+ toMethod:
+ type: string
+ type: object
+ UDGGlobalHeader:
+ properties:
+ key:
+ type: string
+ value:
+ type: string
+ type: object
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ URLRewrite:
+ nullable: true
+ properties:
+ enabled:
+ type: boolean
+ pattern:
+ type: string
+ rewriteTo:
+ type: string
+ triggers:
+ items:
+ $ref: '#/components/schemas/URLRewriteTrigger'
type: array
- throttle_interval:
- example: 10
- format: double
- type: number
- throttle_retry_limit:
- example: -1
- type: integer
type: object
- SignatureConfig:
+ URLRewriteMeta:
properties:
- algorithm:
- type: string
- allowed_clock_skew:
- format: int64
- type: integer
- error_code:
- type: integer
- error_message:
+ disabled:
+ type: boolean
+ match_pattern:
type: string
- header:
+ method:
type: string
- param_name:
+ path:
type: string
- secret:
+ rewrite_to:
type: string
- use_param:
- type: boolean
+ triggers:
+ items:
+ $ref: '#/components/schemas/RoutingTrigger'
+ nullable: true
+ type: array
type: object
x-go-package: github.com/TykTechnologies/tyk/apidef
- State:
+ URLRewriteRule:
properties:
- active:
- type: boolean
- internal:
+ in:
+ type: string
+ name:
+ type: string
+ negate:
type: boolean
+ pattern:
+ type: string
type: object
- StringRegexMap:
+ URLRewriteTrigger:
properties:
- match_rx:
+ condition:
type: string
- reverse:
- type: boolean
+ rewriteTo:
+ type: string
+ rules:
+ items:
+ $ref: '#/components/schemas/URLRewriteRule'
+ type: array
type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- SystemStatsResp:
+ URLVals:
properties:
- message:
+ ApiURL:
type: string
- stats:
- $ref: '#/components/schemas/EntityStats'
- status:
- example: Success
+ BasePath:
+ type: string
+ Host:
type: string
type: object
- Tag:
+ Upstream:
properties:
- description:
- type: string
- externalDocs:
- $ref: '#/components/schemas/ExternalDocs'
- name:
+ certificatePinning:
+ $ref: '#/components/schemas/CertificatePinning'
+ mutualTLS:
+ $ref: '#/components/schemas/MutualTLS'
+ rateLimit:
+ $ref: '#/components/schemas/RateLimit'
+ serviceDiscovery:
+ $ref: '#/components/schemas/ServiceDiscovery'
+ test:
+ $ref: '#/components/schemas/Test'
+ url:
type: string
type: object
- Tags:
- items:
- $ref: '#/components/schemas/Tag'
- type: array
- TemplateData:
+ UptimeTests:
properties:
- enable_session:
+ check_list:
+ items:
+ $ref: '#/components/schemas/HostCheckObject'
+ nullable: true
+ type: array
+ config:
+ $ref: '#/components/schemas/UptimeTestsConfig'
+ type: object
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ UptimeTestsConfig:
+ properties:
+ expire_utime_after:
+ format: int64
+ type: integer
+ recheck_wait:
+ type: integer
+ service_discovery:
+ $ref: '#/components/schemas/ServiceDiscoveryConfiguration'
+ type: object
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ User:
+ properties:
+ access_key:
+ example: d7ebef749e4348cb67fec3cfc81f0a50
+ type: string
+ active:
+ example: true
type: boolean
- input_type:
+ api_model:
+ $ref: '#/components/schemas/ApiModel'
+ created_at:
+ example: "2024-05-19T08:23:29.034+03:00"
+ format: date-time
type: string
- template_mode:
+ email_address:
+ example: multi-org-user@example.org
type: string
- template_source:
+ first_name:
+ example: itachi
+ type: string
+ group_id:
+ example: 5e9d9544a1dcd60001d0ed20
+ type: string
+ id:
+ example: 66498cd1e2fcd1000184ecb5
+ type: string
+ last_login_date:
+ example: "2024-05-19T08:42:22.659839+03:00"
+ format: date-time
+ type: string
+ last_name:
+ example: sasuke
+ type: string
+ org_id:
+ example: 5e9d9544a1dcd60001d0ed20
+ type: string
+ password_max_days:
+ example: 0
+ type: integer
+ password_updated:
+ example: "2024-05-19T08:23:29.146+03:00"
+ format: date-time
type: string
+ user_permissions:
+ $ref: '#/components/schemas/UserPermissionObject'
+ required:
+ - first_name
+ - last_name
+ - email_address
+ - user_permissions
type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- TemplateMeta:
+ UserGroup:
properties:
- disabled:
+ active:
+ example: true
type: boolean
- method:
+ description:
+ example: Devops logs and analytics access
type: string
- path:
+ id:
+ example: 6649986d5715ec4c96cbef2b
type: string
- template_data:
- $ref: '#/components/schemas/TemplateData'
+ name:
+ example: 66498cd1e2fcd1000184ecb8
+ type: string
+ org_id:
+ example: 5e9d9544a1dcd60001d0ed20
+ type: string
+ password_max_days:
+ example: 0
+ type: integer
+ user_permissions:
+ $ref: '#/components/schemas/UserPermissionObject'
type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- Test:
- nullable: true
+ UserGroups:
properties:
- serviceDiscovery:
- $ref: '#/components/schemas/ServiceDiscovery'
+ groups:
+ items:
+ $ref: '#/components/schemas/UserGroup'
+ nullable: true
+ type: array
+ pages:
+ type: integer
type: object
- TimeDuration:
- format: duration
- type: string
- example: "30s"
- TimeReadableDuration:
- format: duration
- type: string
- example: PT2H30M15S
- TrackEndpoint:
- nullable: true
+ UserPassword:
properties:
- enabled:
- type: boolean
+ api_model:
+ $ref: '#/components/schemas/ApiModel'
+ current_password:
+ example: testuser1password
+ minLength: 6
+ type: string
+ new_password:
+ example: newtestuser1password
+ minLength: 6
+ type: string
type: object
- TrackEndpointMeta:
+ UserPermissionObject:
+ additionalProperties:
+ type: string
+ type: object
+ UserSearchPayload:
+ properties:
+ filters:
+ properties:
+ query:
+ example: itachi@tyk.io
+ type: string
+ type: object
+ type: object
+ Users:
+ properties:
+ pages:
+ type: integer
+ users:
+ items:
+ $ref: '#/components/schemas/User'
+ nullable: true
+ type: array
+ type: object
+ ValidatePathMeta:
properties:
disabled:
type: boolean
+ error_response_code:
+ type: integer
method:
type: string
path:
type: string
+ schema:
+ additionalProperties: {}
+ nullable: true
+ type: object
+ schema_b64:
+ type: string
type: object
x-go-package: github.com/TykTechnologies/tyk/apidef
- TrafficLogs:
+ ValidateRequest:
nullable: true
properties:
enabled:
type: boolean
+ errorResponseCode:
+ type: integer
type: object
- TransformBody:
- nullable: true
+ ValidateRequestMeta:
properties:
- body:
- type: string
enabled:
type: boolean
- format:
+ error_response_code:
+ type: integer
+ method:
type: string
path:
type: string
type: object
- TransformHeaders:
- nullable: true
- properties:
- add:
- $ref: '#/components/schemas/Headers'
- enabled:
- type: boolean
- remove:
- items:
- type: string
- type: array
- type: object
- TransformJQMeta:
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ VersionData:
properties:
- filter:
- type: string
- method:
- type: string
- path:
+ default_version:
type: string
+ not_versioned:
+ type: boolean
+ versions:
+ additionalProperties:
+ $ref: '#/components/schemas/VersionInfo'
+ nullable: true
+ type: object
type: object
x-go-package: github.com/TykTechnologies/tyk/apidef
- TransformRequestMethod:
- nullable: true
+ VersionDefinition:
properties:
+ default:
+ type: string
enabled:
type: boolean
- toMethod:
- type: string
- type: object
- UDGGlobalHeader:
- properties:
+ fallback_to_default:
+ type: boolean
key:
type: string
- value:
+ location:
type: string
+ name:
+ type: string
+ strip_path:
+ type: boolean
+ strip_versioning_data:
+ type: boolean
+ url_versioning_pattern:
+ type: string
+ versions:
+ additionalProperties:
+ type: string
+ nullable: true
+ type: object
type: object
x-go-package: github.com/TykTechnologies/tyk/apidef
- URLRewrite:
- nullable: true
+ VersionInfo:
properties:
- enabled:
- type: boolean
- pattern:
- type: string
- rewriteTo:
+ expires:
type: string
- triggers:
+ extended_paths:
+ $ref: '#/components/schemas/ExtendedPathsSet'
+ global_headers:
+ additionalProperties:
+ type: string
+ nullable: true
+ type: object
+ global_headers_disabled:
+ type: boolean
+ global_headers_remove:
items:
- $ref: '#/components/schemas/URLRewriteTrigger'
+ type: string
+ nullable: true
type: array
- type: object
- URLRewriteMeta:
- properties:
- disabled:
+ global_response_headers:
+ additionalProperties:
+ type: string
+ nullable: true
+ type: object
+ global_response_headers_disabled:
type: boolean
- match_pattern:
- type: string
- method:
- type: string
- path:
- type: string
- rewrite_to:
- type: string
- triggers:
+ global_response_headers_remove:
items:
- $ref: '#/components/schemas/RoutingTrigger'
+ type: string
nullable: true
type: array
+ global_size_limit:
+ format: int64
+ type: integer
+ global_size_limit_disabled:
+ type: boolean
+ global_enforce_timeout:
+ type: string
+ example: "5s"
+ global_enforce_timeout_disabled:
+ type: boolean
+ ignore_endpoint_case:
+ type: boolean
+ name:
+ type: string
+ override_target:
+ type: string
+ paths:
+ properties:
+ black_list:
+ items:
+ type: string
+ nullable: true
+ type: array
+ ignored:
+ items:
+ type: string
+ nullable: true
+ type: array
+ white_list:
+ items:
+ type: string
+ nullable: true
+ type: array
+ type: object
+ use_extended_paths:
+ type: boolean
type: object
x-go-package: github.com/TykTechnologies/tyk/apidef
- URLRewriteRule:
+ VersionMeta:
properties:
- in:
+ expirationDate:
type: string
- name:
+ id:
type: string
- negate:
+ internal:
type: boolean
- pattern:
+ isDefaultVersion:
+ type: boolean
+ name:
+ type: string
+ versionName:
type: string
type: object
- URLRewriteTrigger:
+ VersionMetas:
properties:
- condition:
- type: string
- rewriteTo:
- type: string
- rules:
+ apis:
items:
- $ref: '#/components/schemas/URLRewriteRule'
+ $ref: '#/components/schemas/VersionMeta'
+ nullable: true
type: array
+ pages:
+ type: integer
type: object
- URLVals:
+ VersionToID:
properties:
- ApiURL:
- type: string
- BasePath:
+ id:
type: string
- Host:
+ name:
type: string
type: object
- Upstream:
+ Versioning:
+ nullable: true
properties:
- certificatePinning:
- $ref: '#/components/schemas/CertificatePinning'
- mutualTLS:
- $ref: '#/components/schemas/MutualTLS'
- rateLimit:
- $ref: '#/components/schemas/RateLimit'
- serviceDiscovery:
- $ref: '#/components/schemas/ServiceDiscovery'
- test:
- $ref: '#/components/schemas/Test'
- url:
+ default:
type: string
- type: object
- UptimeTests:
- properties:
- check_list:
+ enabled:
+ type: boolean
+ fallbackToDefault:
+ type: boolean
+ key:
+ type: string
+ location:
+ type: string
+ name:
+ type: string
+ stripVersioningData:
+ type: boolean
+ urlVersioningPattern:
+ type: string
+ versions:
items:
- $ref: '#/components/schemas/HostCheckObject'
+ $ref: '#/components/schemas/VersionToID'
nullable: true
type: array
- config:
- $ref: '#/components/schemas/UptimeTestsConfig'
- type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- UptimeTestsConfig:
- properties:
- expire_utime_after:
- format: int64
- type: integer
- recheck_wait:
- type: integer
- service_discovery:
- $ref: '#/components/schemas/ServiceDiscoveryConfiguration'
type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- User:
+ VirtualEndpoint:
+ nullable: true
properties:
- access_key:
- example: d7ebef749e4348cb67fec3cfc81f0a50
+ body:
type: string
- active:
- example: true
+ enabled:
type: boolean
- api_model:
- $ref: '#/components/schemas/ApiModel'
- created_at:
- example: "2024-05-19T08:23:29.034+03:00"
- format: date-time
- type: string
- email_address:
- example: multi-org-user@example.org
+ functionName:
type: string
- first_name:
- example: itachi
+ name:
type: string
- group_id:
- example: 5e9d9544a1dcd60001d0ed20
+ path:
type: string
- id:
- example: 66498cd1e2fcd1000184ecb5
+ proxyOnError:
+ type: boolean
+ requireSession:
+ type: boolean
+ type: object
+ VirtualMeta:
+ properties:
+ disabled:
+ type: boolean
+ function_source_type:
type: string
- last_login_date:
- example: "2024-05-19T08:42:22.659839+03:00"
- format: date-time
+ function_source_uri:
type: string
- last_name:
- example: sasuke
+ method:
type: string
- org_id:
- example: 5e9d9544a1dcd60001d0ed20
+ path:
type: string
- password_max_days:
- example: 0
- type: integer
- password_updated:
- example: "2024-05-19T08:23:29.146+03:00"
- format: date-time
+ proxy_on_error:
+ type: boolean
+ response_function_name:
type: string
- user_permissions:
- $ref: '#/components/schemas/UserPermissionObject'
- required:
- - first_name
- - last_name
- - email_address
- - user_permissions
+ use_session:
+ type: boolean
type: object
- UserGroup:
+ x-go-package: github.com/TykTechnologies/tyk/apidef
+ WebHookHandlerConf:
properties:
- active:
- example: true
- type: boolean
- description:
- example: Devops logs and analytics access
- type: string
+ api_model:
+ $ref: '#/components/schemas/ApiModel'
+ event_timeout:
+ example: 0
+ format: int64
+ type: integer
+ header_map:
+ additionalProperties:
+ type: string
+ example:
+ secret: superscretkey
+ x-auth: authvalue
+ nullable: true
+ type: object
id:
- example: 6649986d5715ec4c96cbef2b
+ example: 664b613f5715ec4c96cbef3e
+ type: string
+ method:
+ example: POST
type: string
name:
- example: 66498cd1e2fcd1000184ecb8
+ example: Expired Keys webhook
type: string
org_id:
example: 5e9d9544a1dcd60001d0ed20
type: string
- password_max_days:
- example: 0
- type: integer
- user_permissions:
- $ref: '#/components/schemas/UserPermissionObject'
+ target_path:
+ example: https://httpbin.org/expired-keys
+ type: string
+ template_path:
+ example: templates/default_webhook.json
+ type: string
+ webhook_id:
+ example: 1f78e319202b430e92286cff3ca759e3
+ type: string
+ required:
+ - method
+ - target_path
type: object
- UserGroups:
+ WebHooks:
properties:
- groups:
+ hooks:
items:
- $ref: '#/components/schemas/UserGroup'
+ $ref: '#/components/schemas/WebHookHandlerConf'
nullable: true
type: array
pages:
type: integer
type: object
- UserPassword:
+ XTykAPIGateway:
properties:
- api_model:
- $ref: '#/components/schemas/ApiModel'
- current_password:
- example: testuser1password
- minLength: 6
- type: string
- new_password:
- example: newtestuser1password
- minLength: 6
- type: string
+ info:
+ $ref: '#/components/schemas/Info'
+ middleware:
+ $ref: '#/components/schemas/Middleware'
+ server:
+ $ref: '#/components/schemas/Server'
+ upstream:
+ $ref: '#/components/schemas/Upstream'
type: object
- UserPermissionObject:
- additionalProperties:
- type: string
+ TykVendorExtension:
+ properties:
+ x-tyk-api-gateway:
+ $ref: '#/components/schemas/XTykAPIGateway'
type: object
- UserSearchPayload:
+ XTykStreaming:
properties:
- filters:
- properties:
- query:
- example: itachi@tyk.io
- type: string
+ x-tyk-streaming:
type: object
+ properties:
+ streams:
+ type: object
+ additionalProperties: true
+ #to be added
+ MigrateAPIRequest:
type: object
- Users:
+ required:
+ - mode
properties:
- pages:
- type: integer
- users:
- items:
- $ref: '#/components/schemas/User'
- nullable: true
+ apiIDs:
type: array
- type: object
- ValidatePathMeta:
- properties:
- disabled:
+ items:
+ type: string
+ description: List of API IDs to migrate. Cannot be used together with 'all'
+ all:
type: boolean
- error_response_code:
- type: integer
- method:
- type: string
- path:
- type: string
- schema:
- additionalProperties: {}
- nullable: true
- type: object
- schema_b64:
+ description: Migrate all APIs. Cannot be used together with 'apiIDs'
+ abortOnFailure:
+ type: boolean
+ description: Stop migration process on first failure
+ mode:
type: string
+ enum:
+ - dryRun
+ - stage
+ - promote
+ - direct
+ description: Migration mode to use
+ overrideStaged:
+ type: boolean
+ description: When mode is staged and overrideStaged is set to true, migration process will overwrite already existing staged API with the same staged ID
+ MigrateAPIResponse:
+ description: migration API response object
type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- ValidateRequest:
- nullable: true
properties:
- enabled:
+ success:
+ description: reports details of APIs migrated successfully
+ type: object
+ properties:
+ count:
+ description: count of APIs migrated successfully
+ type: integer
+ apiIDs:
+ description: list of API IDs migrated successfully
+ type: array
+ items:
+ type: string
+ stagedAPIs:
+ description: reports the details of APIs staged in stage mode
+ type: array
+ items:
+ type: object
+ properties:
+ classicAPIID:
+ type: string
+ oasAPIID:
+ type: string
+ definitions:
+ type: array
+ items:
+ type: object
+ properties:
+ apiID:
+ type: string
+ baseAPI:
+ description: contains the migrated base API in Tyk OAS format
+ type: object
+ versions:
+ description: contains the versioned API definitions in Tyk OAS format
+ type: array
+ items:
+ type: object
+ failure:
+ description: reports the details of failed API migrations
+ type: object
+ properties:
+ count:
+ description: count of APIs failed migration
+ type: integer
+ errors:
+ description: details of errors occurred during migration
+ type: array
+ items:
+ type: object
+ properties:
+ apiID:
+ type: string
+ message:
+ type: array
+ items:
+ type: string
+ skipped:
+ description: reports the details of skipped APIs
+ type: object
+ properties:
+ count:
+ type: integer
+ apis:
+ type: array
+ items:
+ type: object
+ properties:
+ apiID:
+ type: string
+ message:
+ type: string
+ key:
+ type: string
+ nullable: true
+ enum:
+ - already_migrated
+ - already_staged
+ - is_tcp
+ - is_streams
+ - is_graphql
+ - is_websocket
+ - not_staged
+
+ abortedOnFailure:
+ description: reports whether migration process aborted on first failure
type: boolean
- errorResponseCode:
- type: integer
+ RulesetRequest:
type: object
- ValidateRequestMeta:
+ required:
+ - name
+ - definition
properties:
- enabled:
- type: boolean
- error_response_code:
- type: integer
- method:
+ name:
type: string
- path:
+ ruleset_id:
type: string
- type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- VersionData:
- properties:
- default_version:
+ description: >
+ Optional stable identifier. If not provided, defaults to the record's internal ID hex.
+ Must be unique within the org. Never changed after creation.
+ description:
type: string
- not_versioned:
+ active:
type: boolean
- versions:
- additionalProperties:
- $ref: '#/components/schemas/VersionInfo'
+ resource_type:
+ type: string
+ enum: [oas-api, mcp-api]
+ action:
+ type: string
+ enum: [none, warn]
+ categories:
+ type: array
nullable: true
- type: object
+ items:
+ type: string
+ description: >
+ Optional list of category names to associate with this ruleset.
+ Each value must match an existing org API category
+ (as returned by GET /apis/categories); matching is case-insensitive.
+ Unknown values are rejected with 400.
+ Entries are sanitized before validation and storage: surrounding
+ whitespace is trimmed, empty entries are dropped, and
+ case-insensitive duplicates are removed (first occurrence wins).
+ example: ["payments", "internal"]
+ definition:
+ type: string
+ description: Full Spectral ruleset definition stored as a JSON string.
+
+ Ruleset:
type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- VersionDefinition:
properties:
- default:
+ _id:
type: string
- enabled:
- type: boolean
- fallback_to_default:
- type: boolean
- key:
+ ruleset_id:
type: string
- location:
+ description: Stable migration identifier. Same value across environments.
+ org_id:
type: string
name:
type: string
- strip_path:
- type: boolean
- strip_versioning_data:
+ description:
+ type: string
+ active:
type: boolean
- url_versioning_pattern:
+ resource_type:
type: string
- versions:
- additionalProperties:
- type: string
- nullable: true
- type: object
- type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- VersionInfo:
- properties:
- expires:
+ action:
type: string
- extended_paths:
- $ref: '#/components/schemas/ExtendedPathsSet'
- global_headers:
- additionalProperties:
- type: string
- nullable: true
- type: object
- global_headers_disabled:
- type: boolean
- global_headers_remove:
- items:
- type: string
- nullable: true
+ categories:
type: array
- global_response_headers:
- additionalProperties:
- type: string
nullable: true
- type: object
- global_response_headers_disabled:
- type: boolean
- global_response_headers_remove:
items:
type: string
- nullable: true
- type: array
- global_size_limit:
- format: int64
- type: integer
- ignore_endpoint_case:
- type: boolean
- name:
+ owner:
type: string
- override_target:
+ description: ID of the user who created the ruleset. Set server-side from the session; cannot be supplied by the caller.
+ definition:
type: string
- paths:
- properties:
- black_list:
- items:
- type: string
- nullable: true
- type: array
- ignored:
- items:
- type: string
- nullable: true
- type: array
- white_list:
- items:
- type: string
- nullable: true
- type: array
- type: object
- use_extended_paths:
+ description: Full Spectral ruleset definition stored as a JSON string.
+ is_template:
type: boolean
+ date_created:
+ type: string
+ format: date-time
+ last_updated:
+ type: string
+ format: date-time
+
+ AppliedRule:
type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- VersionMeta:
+ description: >
+ A single rule that will fire when this ruleset is evaluated against an API.
+ Rules are resolved from the definition's `extends` directives and inline overrides
+ at read time — they are never stored.
properties:
- expirationDate:
- type: string
id:
type: string
- internal:
- type: boolean
- isDefaultVersion:
- type: boolean
- name:
+ description: Rule identifier.
+ example: operation-operationId
+ description:
type: string
- versionName:
+ description: Human-readable description of what the rule checks.
+ message:
+ type: string
+ description: Message shown when the rule fails.
+ severity:
+ type: string
+ enum: [error, warn, info, hint]
+ example: warn
+ type:
type: string
+ enum: [style, validation]
+ recommended:
+ type: boolean
+ description: Whether this rule is in the recommended subset.
+ how_to_fix:
+ type: string
+ description: Guidance on how to resolve a violation.
+
+ RulesetDetail:
+ allOf:
+ - $ref: '#/components/schemas/Ruleset'
+ - type: object
+ properties:
+ applied_rules:
+ type: array
+ description: >
+ Full list of rules that would fire when this ruleset is evaluated,
+ after resolving any `extends` directives.
+ Computed at read time, never persisted. Empty when resolution fails.
+ items:
+ $ref: '#/components/schemas/AppliedRule'
+
+ RulesetList:
type: object
- VersionMetas:
properties:
- apis:
- items:
- $ref: '#/components/schemas/VersionMeta'
- nullable: true
+ rulesets:
type: array
+ items:
+ $ref: '#/components/schemas/Ruleset'
pages:
type: integer
+
+ LintViolationLocation:
type: object
- VersionToID:
+ description: Source position of the violation in the OAS document.
properties:
- id:
- type: string
- name:
- type: string
+ start_line:
+ type: integer
+ start_char:
+ type: integer
+ end_line:
+ type: integer
+ end_char:
+ type: integer
+
+ LintViolation:
type: object
- Versioning:
- nullable: true
+ description: A single rule violation produced by one governance evaluation run.
properties:
- default:
+ _id:
type: string
- enabled:
- type: boolean
- fallbackToDefault:
- type: boolean
- key:
+ description: >
+ Row identifier. Persisted violations carry a MongoDB ObjectId hex;
+ sandbox evaluations persist nothing, so their rows carry a
+ deterministic 16-hex content hash instead (stable across re-runs
+ of identical inputs).
+ org_id:
type: string
- location:
+ api_id:
type: string
- name:
+ ruleset_id:
type: string
- stripVersioningData:
- type: boolean
- urlVersioningPattern:
+ ruleset_name:
type: string
- versions:
- items:
- $ref: '#/components/schemas/VersionToID'
- nullable: true
+ description: Human-readable ruleset name resolved from tyk_rulesets. Omitted when the referenced ruleset no longer exists (e.g. it was deleted while an evaluation was in flight); sandbox evaluation responses always include it.
+ rule_id:
+ type: string
+ description: Spectral rule name that fired.
+ rule_summary:
+ type: string
+ description: Short human-readable description of the rule.
+ how_to_fix:
+ type: string
+ description: Remediation guidance for this rule.
+ message:
+ type: string
+ description: Violation message produced by the rule engine.
+ severity:
+ type: string
+ enum: [error, warn, info, hint]
+ severity_order:
+ type: integer
+ description: Numeric sort key (1=error, 2=warn, 3=info, 4=hint).
+ path:
+ type: string
+ description: Dot-joined JSON path to the violating node (e.g. `paths./pets.get`).
+ location:
+ $ref: '#/components/schemas/LintViolationLocation'
+ created_at:
+ type: string
+ format: date-time
+
+ APIComplianceResult:
+ type: object
+ description: >
+ Governance compliance summary for one API. Returned by
+ GET /api/governance/apis/{apiID}/compliance.
+ properties:
+ overall_status:
+ type: string
+ enum: [compliant, non_compliant, in_process, not_evaluated]
+ description: >
+ compliant = all completed rulesets have zero errors.
+ non_compliant = at least one completed ruleset has error_count > 0.
+ in_process = no failing completed ruleset, but at least one evaluation is still running.
+ not_evaluated = no records exist, or all evaluations failed.
+ rulesets:
type: array
+ items:
+ $ref: '#/components/schemas/RulesetComplianceEntry'
+
+ RulesetComplianceEntry:
type: object
- VirtualEndpoint:
- nullable: true
+ description: Per-ruleset compliance entry within an APIComplianceResult.
properties:
- body:
+ ruleset_id:
type: string
- enabled:
- type: boolean
- functionName:
+ ruleset_name:
type: string
- name:
+ description: Human-readable name resolved from tyk_rulesets.
+ status:
type: string
- path:
+ enum: [in_process, completed, failed]
+ compliance:
type: string
- proxyOnError:
- type: boolean
- requireSession:
- type: boolean
+ enum: [compliant, non_compliant]
+ description: Only present when status is "completed".
+ evaluated_at:
+ type: string
+ format: date-time
+ nullable: true
+ description: Null when status is in_process.
+ error_count:
+ type: integer
+ description: Violations at severity=error. error_count > 0 means non-compliant.
+ warn_count:
+ type: integer
+ info_count:
+ type: integer
+ hint_count:
+ type: integer
+ compliance_level:
+ type: integer
+ minimum: 0
+ maximum: 100
+ nullable: true
+ description: >
+ Integer 0–100. Present only when status is "completed" and the ruleset has
+ applied rules. Formula: (applied_rules_count - unique_violated_rules)
+ / applied_rules_count × 100.
+
+ LintViolationList:
+ type: object
+ properties:
+ violations:
+ type: array
+ items:
+ $ref: '#/components/schemas/LintViolation'
+ pages:
+ type: integer
+ description: Total number of pages at the current page size. 0 when all results are returned.
+
+ ScopeMapping:
+ type: object
+ description: Scope-to-policy mapping for a single API.
+ properties:
+ scope_to_policy:
+ type: object
+ description: Map of scope name → policy ID.
+ additionalProperties:
+ type: string
+ example:
+ read: "665d51505715ec2d76022c87"
+ write: "5e4f2c1a3b6d7e8f9a0b1c2d"
+
+ ClientIdPRequest:
type: object
- VirtualMeta:
+ required:
+ - name
+ - jwks_uri
properties:
- disabled:
- type: boolean
- function_source_type:
+ client_idp_id:
type: string
- function_source_uri:
+ description: >
+ Optional stable identifier. If not provided, defaults to the record's internal ID hex.
+ Must be unique within the org.
+ name:
type: string
- method:
+ description: Human-readable name. Required.
+ issuer:
type: string
- path:
+ description: Issuer URL. Optional — used as a selection hint downstream; an empty value is accepted.
+ jwks_uri:
type: string
- proxy_on_error:
- type: boolean
- response_function_name:
+ description: JWKS endpoint URL. Required — this is the IdP's signing-key source with no discovery fallback.
+ scope_claim_name:
type: string
- use_session:
- type: boolean
- type: object
- x-go-package: github.com/TykTechnologies/tyk/apidef
- WebHookHandlerConf:
- properties:
- api_model:
- $ref: '#/components/schemas/ApiModel'
- event_timeout:
- example: 0
- format: int64
- type: integer
- header_map:
+ description: >
+ JWT claim that holds the OAuth scopes (e.g. `scope`, `scp`, `roles`). Optional — when empty
+ the gateway falls back to the `scope` claim.
+ api_mappings:
+ type: object
+ description: Map of api_id → `ScopeMapping`. Defaults to an empty map if not provided.
additionalProperties:
- type: string
+ $ref: '#/components/schemas/ScopeMapping'
example:
- secret: superscretkey
- x-auth: authvalue
- nullable: true
- type: object
- id:
- example: 664b613f5715ec4c96cbef3e
+ b84fe1a04e5648927971c0557971565c:
+ scope_to_policy:
+ read: "665d51505715ec2d76022c87"
+
+ ClientIdP:
+ type: object
+ description: A client Identity Provider stored beside API definitions.
+ properties:
+ _id:
type: string
- method:
- example: POST
+ description: Internal record ID hex. Set server-side on creation.
+ client_idp_id:
+ type: string
+ description: Stable user-facing identifier. Defaults to `_id` hex when not supplied on create.
+ org_id:
type: string
+ description: Organisation ID. Set server-side from the session; cannot be overridden.
name:
- example: Expired Keys webhook
type: string
- org_id:
- example: 5e9d9544a1dcd60001d0ed20
+ issuer:
type: string
- target_path:
- example: https://httpbin.org/expired-keys
+ jwks_uri:
type: string
- template_path:
- example: templates/default_webhook.json
+ scope_claim_name:
type: string
- webhook_id:
- example: 1f78e319202b430e92286cff3ca759e3
+ description: JWT claim holding the OAuth scopes (e.g. `scope`, `scp`, `roles`). Empty falls back to `scope` gateway-side.
+ api_mappings:
+ type: object
+ description: Map of api_id → `ScopeMapping`.
+ additionalProperties:
+ $ref: '#/components/schemas/ScopeMapping'
+ example:
+ b84fe1a04e5648927971c0557971565c:
+ scope_to_policy:
+ read: "665d51505715ec2d76022c87"
+ date_created:
type: string
- required:
- - method
- - target_path
+ format: date-time
+ last_updated:
+ type: string
+ format: date-time
+
+ ClientIdPList:
type: object
- WebHooks:
properties:
- hooks:
- items:
- $ref: '#/components/schemas/WebHookHandlerConf'
- nullable: true
+ client_idps:
type: array
+ items:
+ $ref: '#/components/schemas/ClientIdP'
pages:
type: integer
+
+ ScopeMappingPatch:
type: object
- XTykAPIGateway:
+ description: >
+ Patch shape for a single API's scope mapping.
+ `scope_to_policy` is a free-form JSON object so that individual scope keys
+ can be set to `null` (to remove them) as per RFC 7386 merge-patch semantics.
properties:
- info:
- $ref: '#/components/schemas/Info'
- middleware:
- $ref: '#/components/schemas/Middleware'
- server:
- $ref: '#/components/schemas/Server'
- upstream:
- $ref: '#/components/schemas/Upstream'
- type: object
- TykVendorExtension:
+ scope_to_policy:
+ type: object
+ description: >
+ Map of scope name → policy ID. Set a key to `null` to remove that scope;
+ omit a key to leave it untouched.
+
+ APIMappingsPatch:
+ type: object
+ description: >
+ RFC 7386 JSON Merge Patch body for `PATCH /api/clientidps/{id}/mappings`.
+ Each key is an `api_id`. A `ScopeMappingPatch` value upserts that mapping;
+ a `null` value deletes the entire mapping for that `api_id`.
+ Keys absent from the body are left untouched at every nesting level —
+ this includes individual scope keys inside `scope_to_policy`.
+ To remove a single scope, set it to `null` inside `scope_to_policy`;
+ omitting it has no effect.
+ additionalProperties:
+ type: object
+ nullable: true
+ allOf:
+ - $ref: '#/components/schemas/ScopeMappingPatch'
+ example:
+ 4c1c0d8fc885401053ddac4e39ef676b:
+ scope_to_policy:
+ read: "665d51505715ec2d76022c87"
+ write: null
+
+ SandboxContentRequest:
+ type: object
+ required: [content]
+ additionalProperties: false
+ description: >
+ Envelope transport for `POST /api/evaluations/sandbox/oas`. Carries
+ the API definition as a string and nothing else — evaluation
+ metadata (`ruleset_ids`, `categories`, `api_id`, `api_name`) stays
+ in query params. Extra fields are rejected with 400.
properties:
- x-tyk-api-gateway:
- $ref: '#/components/schemas/XTykAPIGateway'
+ content:
+ type: string
+ description: >
+ The OpenAPI/Tyk OAS definition as a string — JSON or YAML,
+ auto-detected (JSON parse attempted first, then YAML). Same
+ accepted document shape as raw-body mode.
+
+ TykOasApiDefinition:
type: object
- XTykStreaming:
+ additionalProperties: true
+ required: [openapi]
properties:
- x-tyk-streaming:
- type: object
- properties:
- streams:
- type: object
- additionalProperties: true
- #to be added
- MigrateAPIRequest:
+ openapi:
+ type: string
+ description: OpenAPI version declaration, e.g. `3.0.3`.
+ description: >
+ An OpenAPI 3.x document, optionally carrying the
+ `x-tyk-api-gateway` vendor extension — the same body shape accepted
+ by `POST /api/apis/oas` and returned by `GET /api/apis/oas/{apiId}`.
+ The required top-level `openapi` field mirrors the server's own
+ validation and discriminates this schema from the content envelope
+ in `oneOf` unions. Otherwise kept permissive so the merged
+ `swagger.yml` carries no external URL refs; the server validates
+ against the canonical Tyk OAS schema (`apidef/oas/schema/3.0.json`
+ in TykTechnologies/tyk).
+
+ SandboxEvaluationRequest:
+ type: object
+ required: [api_ids]
+ description: >
+ Sandbox evaluation request — saved resources only. **Exactly one**
+ of `ruleset_ids` / `categories` must be provided (non-empty).
+ To evaluate an API definition submitted in the request body, use
+ `POST /api/evaluations/sandbox/oas` instead.
+ properties:
+ ruleset_ids:
+ type: array
+ minItems: 1
+ maxItems: 20
+ items: {type: string}
+ description: >
+ Stable RulesetIDs of saved rulesets in the caller's org.
+ Soft-deleted rulesets are rejected. Inactive rulesets are
+ accepted — sandbox semantics are "test this ruleset",
+ regardless of whether it's currently driving the async
+ dispatcher.
+ categories:
+ type: array
+ minItems: 1
+ maxItems: 10
+ items: {type: string}
+ description: >
+ Category names. Server resolves to every **active**,
+ non-deleted ruleset whose `categories` intersect this list,
+ scoped to the `resource_type` of each resolved API. Use this
+ for the "run an entire compliance category against this API"
+ workflow.
+ api_ids:
+ type: array
+ minItems: 1
+ maxItems: 10
+ items: {type: string}
+ description: APIIDs of saved APIs in the caller's org. Classic (non-OAS) APIs are rejected.
+ example:
+ ruleset_ids: ["rs-payments-v1"]
+ api_ids: ["petstore"]
+
+ SandboxEvaluationResponse:
type: object
- required:
- - mode
+ required: [rulesets, issues, total, truncated, evaluated_apis, elapsed_ms, error_count, warn_count, info_count, hint_count]
properties:
- apiIDs:
+ rulesets:
type: array
- items:
- type: string
- description: List of API IDs to migrate. Cannot be used together with 'all'
- all:
- type: boolean
- description: Migrate all APIs. Cannot be used together with 'apiIDs'
- abortOnFailure:
+ items: {$ref: '#/components/schemas/SandboxRulesetSummary'}
+ description: >
+ Rulesets actually executed in this run. Single-ruleset callers
+ see one entry; category-based callers see the resolved set.
+ Each entry carries the ruleset's configured `action` and its
+ per-ruleset severity counts. Empty array means no rulesets
+ matched the request (category input with no intersection, or
+ the only matches had a different `resource_type` than the APIs).
+ issues:
+ type: array
+ items: {$ref: '#/components/schemas/LintViolation'}
+ description: >
+ Per-rule violations across all evaluated APIs, sorted by
+ severity then location. Capped at `MaxSandboxIssues` (1000)
+ — see `truncated`. Shared row schema with `/api/governance/issues`.
+ total:
+ type: integer
+ description: Un-truncated issue count produced by the engine.
+ truncated:
type: boolean
- description: Stop migration process on first failure
- mode:
+ description: >
+ True when `total > MaxSandboxIssues` and `issues` was capped.
+ FE renders a banner; CI/CD pipelines should treat this as a
+ failure since the build is being gated against partial data.
+ error_count:
+ type: integer
+ description: >
+ Run-wide count of severity-0 (error) issues, computed
+ pre-truncation — trustworthy even when `issues` is capped.
+ Count field names and severity mapping match the persisted
+ `ApiGovernanceResult` summaries (tyk_governance_api_summaries).
+ warn_count:
+ type: integer
+ description: Run-wide severity-1 (warn) issue count, pre-truncation.
+ info_count:
+ type: integer
+ description: Run-wide severity-2 (info) issue count, pre-truncation.
+ hint_count:
+ type: integer
+ description: Run-wide severity-3 (hint) issue count, pre-truncation.
+ evaluated_apis:
+ type: integer
+ description: >
+ Number of APIs the engine actually applied rules against.
+ Always 1 for `/sandbox/oas`.
+ elapsed_ms:
+ type: integer
+ format: int64
+ description: Wall-clock duration of `engine.Evaluate`, in milliseconds.
+ error:
type: string
- enum:
- - dryRun
- - stage
- - promote
- - direct
- description: Migration mode to use
- overrideStaged:
- type: boolean
- description: When mode is staged and overrideStaged is set to true, migration process will overwrite already existing staged API with the same staged ID
- MigrateAPIResponse:
- description: migration API response object
- type: object
+ description: >
+ Joined error string when the engine returned failures for some
+ `(ruleset, api)` pairs (per `errors.Join` from the mechanism
+ story). Absent on full success. Per-pair attribution is
+ deferred — see ticket.
+
+ SandboxRulesetSummary:
+ type: object
+ required: [id, name, resource_type, active, action, error_count, warn_count, info_count, hint_count]
+ description: >
+ Echo + rollup of one ruleset actually used in the run. Counts are
+ computed pre-truncation from this ruleset's issues across all
+ successfully evaluated pairs — trustworthy even when `issues` is
+ capped. A ruleset whose evaluation errored shows zero counts
+ alongside a non-null response `error`; gates must check `error`
+ first.
properties:
- success:
- description: reports details of APIs migrated successfully
- type: object
- properties:
- count:
- description: count of APIs migrated successfully
- type: integer
- apiIDs:
- description: list of API IDs migrated successfully
- type: array
- items:
- type: string
- stagedAPIs:
- description: reports the details of APIs staged in stage mode
- type: array
- items:
- type: object
- properties:
- classicAPIID:
- type: string
- oasAPIID:
- type: string
- definitions:
- type: array
- items:
- type: object
- properties:
- apiID:
- type: string
- baseAPI:
- description: contains the migrated base API in Tyk OAS format
- type: object
- versions:
- description: contains the versioned API definitions in Tyk OAS format
- type: array
- items:
- type: object
- failure:
- description: reports the details of failed API migrations
- type: object
- properties:
- count:
- description: count of APIs failed migration
- type: integer
- errors:
- description: details of errors occurred during migration
- type: array
- items:
- type: object
- properties:
- apiID:
- type: string
- message:
- type: array
- items:
- type: string
- skipped:
- description: reports the details of skipped APIs
- type: object
- properties:
- count:
- type: integer
- apis:
- type: array
- items:
- type: object
- properties:
- apiID:
- type: string
- message:
- type: string
- key:
- type: string
- nullable: true
- enum:
- - already_migrated
- - already_staged
- - is_tcp
- - is_streams
- - is_graphql
- - is_websocket
- - not_staged
+ id: {type: string, description: "Stable RulesetID."}
+ name: {type: string}
+ resource_type: {type: string, enum: [oas-api, mcp-api]}
+ active: {type: boolean, description: "Whether the ruleset is currently active. FE shows an 'inactive' hint when `false`."}
+ action:
+ type: string
+ enum: [none, warn]
+ description: >
+ Verbatim echo of the ruleset's configured action (ruleset CRUD
+ enum — new values appear here without a sandbox schema change).
+ Lets clients gate on "did a ruleset whose action matters produce
+ violations" without scanning `issues`.
+ error_count: {type: integer, description: "Error-severity issues from this ruleset, pre-truncation."}
+ warn_count: {type: integer, description: "Warn-severity issues from this ruleset, pre-truncation."}
+ info_count: {type: integer, description: "Info-severity issues from this ruleset, pre-truncation."}
+ hint_count: {type: integer, description: "Hint-severity issues from this ruleset, pre-truncation."}
- abortedOnFailure:
- description: reports whether migration process aborted on first failure
- type: boolean
securitySchemes:
bearerAuth:
description: The Tyk Dashboard API Access Credentials
diff --git a/swagger/enterprise-developer-portal-swagger.yaml b/swagger/enterprise-developer-portal-swagger.yaml
index 8bfe884d9a..83dad86b36 100644
--- a/swagger/enterprise-developer-portal-swagger.yaml
+++ b/swagger/enterprise-developer-portal-swagger.yaml
@@ -18,7 +18,7 @@ info:
This API requires an admin authorisation token that is available for admin
users of the portal in the profile page.
- version: 1.14.0
+ version: 1.18.0
servers:
- url: http://localhost:3001/portal-api
tags:
@@ -3374,6 +3374,9 @@ paths:
application/json:
schema:
$ref: "#/components/schemas/User-update"
+ example:
+ OrganisationID: 1
+ Teams: ["team-id-1", "team-id-2"]
responses:
"200":
content:
@@ -7794,9 +7797,10 @@ components:
example: false
Teams:
items:
- $ref: "#/components/schemas/Team-show"
+ type: string
+ description: Name of this user's teams
+ example: Default Organisation All users
type: array
- description: Teams that this user belongs to
ID:
type: integer
description: UID of a user
@@ -7821,7 +7825,7 @@ components:
description: Array of team IDs that this user belongs to
items:
type: string
- example: ["team-id-1", "team-id-2"]
+ example: "team-id-1"
ResetPassword:
type: boolean
description: >-
@@ -8183,6 +8187,14 @@ components:
to the Identity provider
examples:
- false
+ ScopeClaimName:
+ type: string
+ description: >-
+ The JWT claim that holds the granted scopes (e.g. "scope" or
+ "scp"). Leave empty to default to "scope".
+ examples:
+ - scope
+ - scp
OAuthProviderCreate:
allOf:
- $ref: "#/components/schemas/OAuthProviderBasic"
@@ -8222,6 +8234,23 @@ components:
description: Timestamp of when this Identity provider was created
examples:
- 2023-06-25 13:37
+ IsDuplicate:
+ type: boolean
+ readOnly: true
+ description: >-
+ True when this provider targets the same Identity Provider as
+ another existing provider. Duplicate providers are rejected at
+ client approval time.
+ examples:
+ - false
+ DuplicateOfID:
+ type: integer
+ readOnly: true
+ description: >-
+ When IsDuplicate is true, the ID of the OAuth 2.0 Provider that
+ this one duplicates. Zero when not a duplicate.
+ examples:
+ - 0
OAuthProviderShow:
allOf:
- $ref: "#/components/schemas/OAuthProviderElem"
diff --git a/swagger/gateway-swagger.yml b/swagger/gateway-swagger.yml
index c69a7d6c23..54f551d3de 100644
--- a/swagger/gateway-swagger.yml
+++ b/swagger/gateway-swagger.yml
@@ -33,7 +33,7 @@ info:
name: Mozilla Public License Version 2.0
url: https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md
title: Tyk Gateway API
- version: 5.13.0
+ version: 5.14.0
servers:
- url: https://{tenant}
variables:
@@ -1599,7 +1599,30 @@ paths:
validated against the MCP JSON schema (`/tyk/schema?type=mcp`) before being
stored. The Gateway must be reloaded (`POST /tyk/reload`) for the new MCP
Proxy definition to take effect.
+
+ When `dryRun=true`, the definition is validated and returned without being
+ persisted, written to disk, versioned, or reloaded. When `expand=true` is
+ also supplied for an internal REST-as-MCP proxy target such as
+ `tyk://orders-rest/mcp`, the response includes the full derived
+ `x-tyk-mcp-server.primitives` catalogue with selected tools marked
+ `allow: true` and unselected tools marked `allow: false`. `expand=true`
+ has no effect for remote MCP proxy upstreams.
operationId: createMCP
+ parameters:
+ - description: Validate and render the MCP Proxy definition without persisting it.
+ in: query
+ name: dryRun
+ required: false
+ schema:
+ default: false
+ type: boolean
+ - description: Expand an internal REST-as-MCP proxy response with the full configurable tool catalogue.
+ in: query
+ name: expand
+ required: false
+ schema:
+ default: false
+ type: boolean
requestBody:
content:
application/json:
@@ -1640,8 +1663,12 @@ paths:
key: e30bee13ad4248c3b529a4c58bb7be4e
status: ok
schema:
- $ref: '#/components/schemas/ApiModifyKeySuccess'
- description: MCP Proxy definition created.
+ oneOf:
+ - $ref: '#/components/schemas/ApiModifyKeySuccess'
+ - allOf:
+ - $ref: '#/components/schemas/OpenAPI3Schema'
+ - $ref: '#/components/schemas/TykVendorExtension'
+ description: MCP Proxy definition created, or validated dry-run OAS returned.
"400":
content:
application/json:
@@ -1669,8 +1696,21 @@ paths:
schema:
type: string
get:
- description: Retrieve a single MCP Proxy definition by its ID.
+ description: Retrieve a single MCP Proxy definition by its ID. When
+ `expand=true` is supplied for an internal REST-as-MCP proxy target, the
+ response includes the full derived `x-tyk-mcp-server.primitives`
+ catalogue with selected and unselected tools marked by `allow`. Normal
+ reads return the stored definition exactly. `expand=true` has no effect
+ for remote MCP proxy upstreams.
operationId: getMCP
+ parameters:
+ - description: Expand an internal REST-as-MCP proxy response with the full configurable tool catalogue.
+ in: query
+ name: expand
+ required: false
+ schema:
+ default: false
+ type: boolean
responses:
"200":
content: