Policies Reference

Policies are reusable YAML definitions. The gateway evaluates them as a linear chain (global → product → user → API) on edge routes (/v1/api/..., /v1/webhooks/...).

Canonical reference: Gateway flow policies.

Implementation background: Trigger policy-chain redesign plan.

---

Policy definition

name: my-throttle
type: throttle          # throttle | headers | xml_json | oauth_outbound
direction: inbound      # inbound | outbound | both
config:
  max_requests: 60
  window_seconds: 60
  key_from: ip

Attach policies via ordered chains (not apply_to globs):

# Trigger API layer
invocation:
  policy_chain:
    - my-throttle
    - ref: my-headers
      direction: inbound

Product / user / global chains are edited in the dashboard (Admin → Products).

---

Types (summary)

type	Short description
throttle	Fixed-window rate limit
headers	Add / set / remove headers
xml_json	Body XML ↔ JSON
oauth_outbound	Client-credentials outbound token inject

---

Files

• Definitions: flows/policies/*.yaml (POLICY_DIR)
• Optional on-disk global chains: flows/policy_chains/global/{http,schedule,amqp}.yaml
• Runtime global/product/user chains: identity service (dashboard UI)

flows/policies/
├── example-throttle-ip.yaml
├── example-headers-strip-secret.yaml
├── example-xml-to-json.yaml
└── example-oauth-outbound.yaml