How to write policies

Policies are reusable YAML definitions evaluated by the gateway as a linear chain:

global → product → user → API

See the Policies Reference and Gateway flow policies.

1. Create a policy definition

Place a file under flows/policies/:

name: partner-throttle
type: throttle
direction: inbound
config:
  max_requests: 100
  window_seconds: 60
  key_from: sub

Supported types: throttle, headers, xml_json, oauth_outbound.

2. Attach it to a layer

API / trigger (flows/triggers/*.yaml):

invocation:
  type: http
  gateway_public_path: /v1/api/orders
  policy_chain:
    - partner-throttle
    - example-xml-to-json

Product / user / global: Dashboard → Admin → Products (chain editors).

3. Direction

• inbound — runs before the request is forwarded
• outbound — runs on the response
• both — both phases

A chain step may override direction with { ref: my-policy, direction: outbound }.