Download Plugin Schemas and Metadata for 3.13

fabianrbz · fabianrbz · commit e778a5ed566f · 2025-12-15T11:45:01.000+01:00
diff --git a/app/_data/plugins/referenceable_fields/3.13.json b/app/_data/plugins/referenceable_fields/3.13.json
@@ -610,6 +610,7 @@
   "opentelemetry": [
     "config.access_logs_endpoint",
     "config.logs_endpoint",
+    "config.metrics.endpoint",
     "config.traces_endpoint"
   ],
   "proxy-cache-advanced": [
diff --git a/app/_schemas/gateway/plugins/3.13/AiAwsGuardrails.json b/app/_schemas/gateway/plugins/3.13/AiAwsGuardrails.json
@@ -46,18 +46,22 @@
           "type": "string"
         },
         "guardrails_id": {
-          "description": "The guardrail identifier used in the request to apply the guardrail",
+          "description": "The guardrail identifier used in the request to apply the guardrail.",
           "type": "string"
         },
         "guardrails_version": {
-          "description": "The guardrail version used in the request to apply the guardrail",
+          "description": "The guardrail version used in the request to apply the guardrail. Note that the value of this field must match the pattern `(([1-9][0-9]{0,7})|(DRAFT))` according to the AWS documentation https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ApplyGuardrail.html#API_runtime_ApplyGuardrail_RequestSyntax.",
           "type": "string"
         },
         "response_buffer_size": {
           "default": 100,
           "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrails service. This only applies to the response content guard.",
           "type": "number"
         },
+        "ssl_verify": {
+          "description": "Verify TLS certificate when connecting to the bedrock service.",
+          "type": "boolean"
+        },
         "stop_on_error": {
           "default": true,
           "description": "Stop processing if an error occurs",
diff --git a/app/_schemas/gateway/plugins/3.13/AiAzureContentSafety.json b/app/_schemas/gateway/plugins/3.13/AiAzureContentSafety.json
@@ -97,6 +97,11 @@
           "description": "Set true to tell the caller why their request was rejected, if so.",
           "type": "boolean"
         },
+        "ssl_verify": {
+          "default": false,
+          "description": "Whether to verify the certificate presented by the Azure Content Safety service when using HTTPS.",
+          "type": "boolean"
+        },
         "stop_on_error": {
           "default": true,
           "description": "Stop processing if an error occurs",
diff --git a/app/_schemas/gateway/plugins/3.13/AiLlmAsJudge.json b/app/_schemas/gateway/plugins/3.13/AiLlmAsJudge.json
@@ -153,8 +153,10 @@
               "type": "object"
             },
             "metadata": {
+              "additionalProperties": true,
               "description": "For internal use only. ",
-              "type": "string"
+              "nullable": true,
+              "type": "object"
             },
             "model": {
               "properties": {
diff --git a/app/_schemas/gateway/plugins/3.13/AiMcpProxy.json b/app/_schemas/gateway/plugins/3.13/AiMcpProxy.json
@@ -13,7 +13,7 @@
           "type": "string"
         },
         "default_acl": {
-          "description": "Optional list of default ACL rules keyed by scope (for example, tools).",
+          "description": "Optional list of default ACL rules keyed by scope (for example: tools).",
           "items": {
             "description": "Default ACL entry for the given scope. `deny` has higher precedence than `allow`.",
             "properties": {
@@ -183,7 +183,12 @@
               },
               "parameters": {
                 "description": "The API parameters specification defined in OpenAPI. For example, '[{\"name\": \"city\", \"in\": \"query\", \"description\": \"Name of the city to get the weather for\", \"required\": true, \"schema\": {\"type\": \"string\"}}]'.See https://swagger.io/docs/specification/v3_0/describing-parameters/ for more details.",
-                "type": "string"
+                "items": {
+                  "additionalProperties": true,
+                  "type": "object"
+                },
+                "nullable": true,
+                "type": "array"
               },
               "path": {
                 "description": "The path of the exported API. By default, Kong will extract the path from API configuration. If the configured path is not exactly matched, this field is required. Paths not starting with '/' are treated as relative paths.",
@@ -200,12 +205,16 @@
                 "type": "object"
               },
               "request_body": {
+                "additionalProperties": true,
                 "description": "The API requestBody specification defined in OpenAPI. For example, '{\"content\":{\"application/x-www-form-urlencoded\":{\"schema\":{\"type\":\"object\",\"properties\":{\"color\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}}}}}}'.See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details.",
-                "type": "string"
+                "nullable": true,
+                "type": "object"
               },
               "responses": {
+                "additionalProperties": true,
                 "description": "The API responses specification defined in OpenAPI. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{\"200\":{\"description\":\"Successful response\",\"content\":{\"application/json\":{\"schema\":{\"type\":\"object\",\"properties\":{\"result\":{\"type\":\"string\"}}}}}}}'.See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details.Only one non-error (status code < 400) responses are supported.",
-                "type": "string"
+                "nullable": true,
+                "type": "object"
               },
               "scheme": {
                 "description": "The scheme of the exported API. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it.",
diff --git a/app/_schemas/gateway/plugins/3.13/AiProxyAdvanced.json b/app/_schemas/gateway/plugins/3.13/AiProxyAdvanced.json
@@ -479,8 +479,10 @@
                 "type": "object"
               },
               "metadata": {
+                "additionalProperties": true,
                 "description": "For internal use only. ",
-                "type": "string"
+                "nullable": true,
+                "type": "object"
               },
               "model": {
                 "properties": {
diff --git a/app/_schemas/gateway/plugins/3.13/AiRequestTransformer.json b/app/_schemas/gateway/plugins/3.13/AiRequestTransformer.json
@@ -138,8 +138,10 @@
               "type": "object"
             },
             "metadata": {
+              "additionalProperties": true,
               "description": "For internal use only. ",
-              "type": "string"
+              "nullable": true,
+              "type": "object"
             },
             "model": {
               "properties": {
diff --git a/app/_schemas/gateway/plugins/3.13/AiResponseTransformer.json b/app/_schemas/gateway/plugins/3.13/AiResponseTransformer.json
@@ -138,8 +138,10 @@
               "type": "object"
             },
             "metadata": {
+              "additionalProperties": true,
               "description": "For internal use only. ",
-              "type": "string"
+              "nullable": true,
+              "type": "object"
             },
             "model": {
               "properties": {
diff --git a/app/_schemas/gateway/plugins/3.13/Confluent.json b/app/_schemas/gateway/plugins/3.13/Confluent.json
@@ -386,6 +386,16 @@
           },
           "type": "object"
         },
+        "security": {
+          "properties": {
+            "ssl_verify": {
+              "default": false,
+              "description": "Enables verification of the certificate presented by the server.",
+              "type": "boolean"
+            }
+          },
+          "type": "object"
+        },
         "timeout": {
           "default": 10000,
           "description": "Socket timeout in milliseconds.",
diff --git a/app/_schemas/gateway/plugins/3.13/ConfluentConsume.json b/app/_schemas/gateway/plugins/3.13/ConfluentConsume.json
@@ -329,6 +329,16 @@
           },
           "type": "object"
         },
+        "security": {
+          "properties": {
+            "ssl_verify": {
+              "default": false,
+              "description": "Enables verification of the certificate presented by the server.",
+              "type": "boolean"
+            }
+          },
+          "type": "object"
+        },
         "timeout": {
           "default": 10000,
           "description": "Socket timeout in milliseconds.",
diff --git a/app/_schemas/gateway/plugins/3.13/Datakit.json b/app/_schemas/gateway/plugins/3.13/Datakit.json
@@ -288,6 +288,10 @@
                     "description": "A string representing an SNI (server name indication) value for TLS.",
                     "type": "string"
                   },
+                  "ssl_verify": {
+                    "description": "Whether to verify the TLS certificate when making HTTPS requests.",
+                    "type": "boolean"
+                  },
                   "timeout": {
                     "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.",
                     "maximum": 2147483646,
@@ -419,7 +423,6 @@
                 "description": "transform JSON or lua table to XML",
                 "properties": {
                   "attributes_block_name": {
-                    "default": "#attr",
                     "maxLength": 32,
                     "minLength": 1,
                     "type": "string"
@@ -564,21 +567,18 @@
                     "x-terraform-transform-const": true
                   },
                   "values": {
+                    "additionalProperties": true,
                     "description": "An object with string keys and freeform values",
-                    "type": "string"
+                    "type": "object"
                   }
                 },
-                "required": [
-                  "values"
-                ],
                 "title": "static",
                 "type": "object"
               },
               {
                 "description": "convert XML to JSON",
                 "properties": {
                   "attributes_block_name": {
-                    "default": "#attr",
                     "maxLength": 32,
                     "minLength": 1,
                     "type": "string"
@@ -607,15 +607,6 @@
                     "minLength": 1,
                     "type": "string"
                   },
-                  "outputs": {
-                    "additionalProperties": {
-                      "maxLength": 255,
-                      "minLength": 1,
-                      "type": "string"
-                    },
-                    "description": "a map object converted from XML document. If connected to `request.body` or `response.body`, the output will be a JSON object.",
-                    "type": "object"
-                  },
                   "recognize_type": {
                     "default": true,
                     "type": "boolean"
diff --git a/app/_schemas/gateway/plugins/3.13/HeaderCertAuth.json b/app/_schemas/gateway/plugins/3.13/HeaderCertAuth.json
@@ -112,6 +112,10 @@
           "default": false,
           "description": "Skip consumer lookup once certificate is trusted against the configured CA list.",
           "type": "boolean"
+        },
+        "ssl_verify": {
+          "description": "This option enables verification of the certificate presented by the server of the OCSP responder's URL and by the server of the CRL Distribution Point.",
+          "type": "boolean"
         }
       },
       "required": [
diff --git a/app/_schemas/gateway/plugins/3.13/HttpLog.json b/app/_schemas/gateway/plugins/3.13/HttpLog.json
@@ -116,6 +116,10 @@
           "description": "Number of times to retry when sending data to the upstream server.",
           "type": "integer"
         },
+        "ssl_verify": {
+          "description": "When using TLS, this option enables verification of the certificate presented by the server.",
+          "type": "boolean"
+        },
         "timeout": {
           "default": 10000,
           "description": "An optional timeout in milliseconds when sending data to the upstream server.",
diff --git a/app/_schemas/gateway/plugins/3.13/JwtSigner.json b/app/_schemas/gateway/plugins/3.13/JwtSigner.json
@@ -24,7 +24,7 @@
             "custom_id",
             "username"
           ],
-          "description": "When the plugin tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of alues. Valid values are `id`, `username`, and `custom_id`.",
+          "description": "When the plugin tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are `id`, `username`, and `custom_id`.",
           "items": {
             "enum": [
               "custom_id",
@@ -42,6 +42,10 @@
           },
           "type": "array"
         },
+        "access_token_endpoints_ssl_verify": {
+          "description": "Whether to verify the TLS certificate if any of `access_token_introspection_endpoint`, `access_token_jwks_uri`, or `access_token_keyset` is an HTTPS URI.",
+          "type": "boolean"
+        },
         "access_token_expiry_claim": {
           "default": [
             "exp"
@@ -182,7 +186,7 @@
           "default": [
             "scope"
           ],
-          "description": "Specify the claim/property in access token introspection results (`JSON`) to be verified against values of `config.access_token_introspection_scopes_required`. This supports nested claims. For example, with Keycloak you could use `[ \"realm_access\", \"roles\" ]`, hich can be given as `realm_access,roles` (form post). If the claim is not found in access token introspection results, and you have specified `config.access_token_introspection_scopes_required`, the plugin responds with `403 Forbidden`.",
+          "description": "Specify the claim/property in access token introspection results (`JSON`) to be verified against values of `config.access_token_introspection_scopes_required`. This supports nested claims. For example, with Keycloak you could use `[ \"realm_access\", \"roles\" ]`, which can be given as `realm_access,roles` (form post). If the claim is not found in access token introspection results, and you have specified `config.access_token_introspection_scopes_required`, the plugin responds with `403 Forbidden`.",
           "items": {
             "type": "string"
           },
@@ -486,6 +490,10 @@
           },
           "type": "array"
         },
+        "channel_token_endpoints_ssl_verify": {
+          "description": "Whether to verify the TLS certificate if any of `channel_token_introspection_endpoint`, `channel_token_jwks_uri`, or `channel_token_keyset` is an HTTPS URI.",
+          "type": "boolean"
+        },
         "channel_token_expiry_claim": {
           "default": [
             "exp"
@@ -686,7 +694,7 @@
           "type": "string"
         },
         "channel_token_jwks_uri_client_certificate": {
-          "description": "The client certificate that will be used to authenticate Kong if `access_token_jwks_uri` is an https uri that requires mTLS Auth.",
+          "description": "The client certificate that will be used to authenticate Kong if `channel_token_jwks_uri` is an https uri that requires mTLS Auth.",
           "properties": {
             "id": {
               "type": "string"
@@ -882,7 +890,7 @@
           "type": "string"
         },
         "realm": {
-          "description": "When authentication or authorization fails, or there is an unexpected error, the plugin sends an `WWW-Authenticate` header with the `realm` attribute value.",
+          "description": "When authentication or authorization fails, or there is an unexpected error, the plugin sends a `WWW-Authenticate` header with the `realm` attribute value.",
           "type": "string"
         },
         "remove_access_token_claims": {
diff --git a/app/_schemas/gateway/plugins/3.13/KafkaConsume.json b/app/_schemas/gateway/plugins/3.13/KafkaConsume.json
@@ -342,6 +342,11 @@
             "ssl": {
               "description": "Enables TLS.",
               "type": "boolean"
+            },
+            "ssl_verify": {
+              "default": false,
+              "description": "When using TLS, this option enables verification of the certificate presented by the server.",
+              "type": "boolean"
             }
           },
           "type": "object"
diff --git a/app/_schemas/gateway/plugins/3.13/KafkaLog.json b/app/_schemas/gateway/plugins/3.13/KafkaLog.json
@@ -380,6 +380,11 @@
             "ssl": {
               "description": "Enables TLS.",
               "type": "boolean"
+            },
+            "ssl_verify": {
+              "default": false,
+              "description": "When using TLS, this option enables verification of the certificate presented by the server.",
+              "type": "boolean"
             }
           },
           "type": "object"
diff --git a/app/_schemas/gateway/plugins/3.13/KafkaUpstream.json b/app/_schemas/gateway/plugins/3.13/KafkaUpstream.json
@@ -408,6 +408,11 @@
             "ssl": {
               "description": "Enables TLS.",
               "type": "boolean"
+            },
+            "ssl_verify": {
+              "default": false,
+              "description": "When using TLS, this option enables verification of the certificate presented by the server.",
+              "type": "boolean"
             }
           },
           "type": "object"
diff --git a/app/_schemas/gateway/plugins/3.13/KonnectApplicationAuth.json b/app/_schemas/gateway/plugins/3.13/KonnectApplicationAuth.json
@@ -1847,6 +1847,16 @@
                         "description": "The memcached unix socket path.",
                         "type": "string"
                       },
+                      "session_memcached_ssl": {
+                        "default": false,
+                        "description": "If set to true, uses SSL to connect to memcached",
+                        "type": "boolean"
+                      },
+                      "session_memcached_ssl_verify": {
+                        "default": false,
+                        "description": "If set to true, verifies the validity of the memcached server SSL certificate",
+                        "type": "boolean"
+                      },
                       "session_remember": {
                         "default": false,
                         "description": "Enables or disables persistent sessions.",
diff --git a/app/_schemas/gateway/plugins/3.13/MtlsAuth.json b/app/_schemas/gateway/plugins/3.13/MtlsAuth.json
@@ -100,6 +100,10 @@
           "default": false,
           "description": "Skip consumer lookup once certificate is trusted against the configured CA list.",
           "type": "boolean"
+        },
+        "ssl_verify": {
+          "description": "This option enables verification of the certificate presented by the server of the OCSP responder's URL and by the server of the CRL Distribution Point.",
+          "type": "boolean"
         }
       },
       "required": [
diff --git a/app/_schemas/gateway/plugins/3.13/OasValidation.json b/app/_schemas/gateway/plugins/3.13/OasValidation.json
@@ -16,6 +16,11 @@
           "description": "Indicates whether the api_spec is URI-Encoded.",
           "type": "boolean"
         },
+        "collect_all_errors": {
+          "default": false,
+          "description": "If set to true, collects all validation errors instead of stopping at the first error. Note: Enabling this option with OpenAPI 3.0 will affect performance.",
+          "type": "boolean"
+        },
         "custom_base_path": {
           "description": "The base path to be used for path match evaluation. This value is ignored if `include_base_path` is set to `false`.",
           "type": "string"
diff --git a/app/_schemas/gateway/plugins/3.13/OpenidConnect.json b/app/_schemas/gateway/plugins/3.13/OpenidConnect.json
diff --git a/app/_schemas/gateway/plugins/3.13/Opentelemetry.json b/app/_schemas/gateway/plugins/3.13/Opentelemetry.json
diff --git a/app/_schemas/gateway/plugins/3.13/TcpLog.json b/app/_schemas/gateway/plugins/3.13/TcpLog.json
