Skip to main content
This page lists the fields of every Tyk Operator Custom Resource under its spec. Field names use dot notation for nested objects (proxy.target_url), [] for list items (tags[]), and .{key} for map entries (auth_configs.{key}). Within each group, required fields are listed first. Read-only status fields are not listed.

​
TykOasApiDefinition

TykOasApiDefinitionSpec defines the desired state of TykOasApiDefinition

​
Top-Level Fields

​
string
Categories serve as identifiers for the API definitions, subsequently enabling the filtering of API listings based on these categories.

​
tykOAS

​
object
required
TykOAS provides storage information about Tyk OAS
​
object
required
ConfigmapRef provides information of configmap in which Tyk OAS is stored
​
string
required
KeyName is the key of configmap in which Tyk OAS doc is stored
​
string
required
Name is the name of configmap
​
string
Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource.

​
certificatePinning

​
object
CertificatePinning contains the configuration related to certificate pinning. It is possible to set Kubernetes secrets containing certificates. It is used to set upstream.certificatePinning in Tyk OAS API Definition.
​
boolean
required
Enabled is a boolean flag, if set to true, it enables certificate pinning for the API. Tyk classic API definition: certificate_pinning_disabled
​
object
DomainToPublicKeysMapping maintains the mapping of domain to pinned public keys. Tyk classic API definition: pinned_public_keys
​
string
required
Domain contains the domain name.
​
string
PublicKeyRefs holds a list of Kubernetes secret names that reside in the same namespace as current TykOasApiDefinition resource. The secret needs to be a type of TLS secret where the pinned public key is stored in tls.crt field. Each secret must contain a public key associated with the specified domain name. NOTE If you want to continue using secrets that are already created on Tyk Dashboard, specify their IDs in publicKeys field of TykOasApiDefinition CR. And then, Tyk Operator will merge this array which is specified through publicKeys field with new Tyk Secrets which will be created based on Kubernetes secrets defined in publicKeyRefs.
​
string
PublicKeys contains a list of the public keys IDs pinned to the domain name. It only accepts Tyk IDs of the public keys. If you have Kubernetes secrets containing public keys of the domain, please use publicKeysRefs field instead of this one. As this one only works with already existing public keys on Tyk Dashboard.

​
clientCertificate

​
object
ClientCertificate is used to configure client certificates settings needed for MTLS connection between Tyk and client. It is used to set server.clientCertificate field of Tyk OAS API
​
string
Allowlist stores list of k8s secret names storing client certificates
​
boolean
Enabled activates mTLS for the API.

​
contextRef

​
object
Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
customDomain

​
object
CustomDomain is the domain to bind this API to. This enforces domain matching for client requests. Tyk classic API definition: domain
​
boolean
required
Enabled allow/disallow the usage of the domain.
​
string
required
Name is the name of the domain.
​
string
Certificates defines a field for specifying certificate IDs that the Tyk can utilise to dynamically load certificates for your custom domain. Tyk classic API definition: certificates
​
string
CertificatesRef defines a field for specifying certificates through Kubernetes secrets. Secrets need to be installed within the namespace of the TykOasApiDefinition resource.

​
jwtAuth

​
object
JwtAuth holds the configuration for the JWT middleware.
​
object
DefaultPolicies is a list of policies specified using their name and namespace.
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
​
object
Scopes holds the scope to policy mappings for a claim name.
​
string
ClaimName contains the claim name.
​
object
ScopeToPolicyMapping contains the mappings of scopes to policy IDs.
​
object
PolicyRef contains the referenced policy based on the name/namespace.
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
​
string
Scope contains the scope name.

​
mutualTLS

​
object
MutualTLS represents the configuration for an Upstream mTLS.
​
boolean
required
Enabled indicates if MTLS should be enabled or not.
​
object
DomainToCertificateMapping contains the configuration for an upstream server domain.
​
string
required
Domain refers to the domain name of an upstream server.
​
string
Certificate references to Tyk cert ID
​
string
CertificateRef references the secret containing the domain’s SSL Certificate.

​
upstreamRequestSigning

​
object
UpstreamRequestSigning configures HMAC-based request signing for upstream requests. When enabled, it ensures requests are signed before being sent to the upstream service using hmac-sha256 algorithm.
​
string
Algorithm for request signing. For Certificate, it can rsa-sha256. For Secret, it can be any of hmac-sha1, hmac-sha256, hmac-sha384, hmac-sha512. Allowed values: hmac-sha1, hmac-sha256, hmac-sha384, hmac-sha512, rsa-sha256.
​
string
CertificateRef references the secret containing SSL Certificate.
​
string
keyid is mandatory if algorithm is hmac type
​
object
SecretRef references HMAC secret
​
string
required
KeyName is the key of secret in which Tyk OAS doc is stored
​
string
required
Name is the name of the secret
​
string
Namespace is the namespace of secret. If Namespace is not provided, we assume that the secret is in the same namespace as TykOasApiDefinition resource.

​
versioning

​
object
Versioning provides versioning information about this OAS API
​
boolean
required
Enabled is a boolean flag, if set to true it will enable versioning of the API.
​
string
Default contains the default version name if a request is issued without a version.
​
boolean
FallbackToDefault specifies that the default version of the OAS API should be used if the requested version does not exist.”
​
string
Key contains the name of the key to check for versioning information.
​
string
Location contains versioning location information. It can be one of the following: header, url-param, url. Allowed values: header, url-param, url.
​
string
Name contains the name of the version.
​
boolean
StripVersioningData if enabled, specifies that the API responses will be stripped of versioning data.
​
string
UrlVersioningPattern configure with a regex that matches the versioning identifier format in your URLs. This is essential when using stripVersioningData and fallbackToDefault with location=url.”
​
object
Versions contains a list of versions that map to individual API IDs.
​
string
required
Name contains the name of the referenced TykOasApiDefinition.
​
object
required
TykOasApiDefinitionRef references a TykOasApiDefinition Name and Namespace.
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
ApiDefinition

APIDefinitionSpec represents the configuration for a single proxied API and it’s versions.

​
Top-Level Fields

​
string
required
​
string
required
APIProtocol is the network transport protocol supported by the gateway Allowed values: “, h2c, tcp, tls, http, https.
​
boolean
Active specifies if the api is enabled or not
​
string
AllowedIPs is a list of IP address that are whitelisted.When this is provided all IP address that is not on this list will be blocked and a 403 http status will be returned. The IP address can be IPv4 or IPv6.IP in CIDR notation is also supported.
​
string
Only set this field if you are referring to an existing API def. The Operator will use this APIID to link the CR with the API in Tyk Note: The values in the CR will become the new source of truth, overriding the existing API Definition
​
string
BaseIdentityProvidedBy sets Base Identity Provider for situation when multiple authentication mechanisms are used Allowed values: auth_token, hmac_key, basic_auth_user, jwt_claim, oidc_user, oauth_key.
​
string
BlacklistedIPs is a list of IP address that will be blacklisted.This means if origin IP matches any IP in this list a 403 http status code will be returned. The IP address can be IPv4 or IPv6. IP in CIDR notation is also supported.
​
string
CertificateSecretNames represents the names of the secrets that the controller should look for in the current namespace which contain the certificates.
​
string
Certificates is a list of Tyk Certificate IDs. e.g. orgid+fingerprint. Use CertificateSecretNames if using cert-manager
​
string
​
string
​
object
ConfigData can be used to pass custom attributes (a JSON object) into your middleware, such as a virtual endpoint or header transform. Free-form object with arbitrary keys.
​
string
​
boolean
​
boolean
DisableQuota allows you to disable quota middleware in a given API Definition.
​
boolean
DisableRateLimit allows you to disable rate limits in a given API Definition.
​
boolean
DoNotTrack disables endpoint tracking for this API
​
string
Domain represents a custom host header that the gateway will listen on for this API
​
boolean
EnableContextVars extracts request context variables from the start of the middleware chain. Set this to true to make them available to your transforms. Context Variables are available in the url rewriter, modify headers and body transforms.
​
boolean
​
boolean
EnableDetailedRecording instructs Tyk store the inbound request and outbound response data in HTTP Wire format as part of the Analytics data
​
boolean
EnableIPBlacklisting activates the ip blacklisting middleware.
​
boolean
EnableIPWhiteListing activates the ip whitelisting middleware.
​
boolean
EnableJWT set JWT as the access method for this API.
​
boolean
​
string
For server use only, do not use
​
boolean
Internal tells Tyk Gateway that this is a virtual API. It can only be routed to from other APIs.
​
string
JWTClientIDBaseField is the name of the field on JWT claim to use for client id. This field is mutually exclusive to jwt_identity_base_field, meaning you can only set/use one and jwt_identity_base_field takes precedence when both are set.
​
string
JWTDefaultPolicies is a list of policies that will be used when base policy can’t be extracted from the JWT token. When this list is provided the first element will be used as the base policy while the rest of elements will be applied.
​
integer
JWTExpiresAtValidationSkew adds validation for expired at JWT claim. Given now = current unix time skew = jwt_expires_at_validation_skew exp = expired at If exp > (now - skew) then validation will fail with “token has expired”
​
string
JWTIdentityBaseField Identifies the user or identity to be used in the Claims of the JWT. This will fallback to sub if not found. This field forms the basis of a new “virtual” token that gets used after validation. It means policy attributes are carried forward through Tyk for attribution purposes.
​
integer
JWTIssuedAtValidationSkew adds validation for issued at JWT claim. Given now = current unix time skew = jwt_issued_at_validation_skew iat = the issued at jwt claim If iat > (now + skew) then validation will fail with “token used before issued”
​
integer
JWTNotBeforeValidationSkew adds validation for not before JWT claim. Given now = current unix time skew = jwt_not_before_validation_skew nbf = the not before jwt claim If nbf > (now + skew) then validation will fail with “token is not valid yet”
​
string
JWTPolicyFieldName The policy ID to apply to the virtual token generated for a JWT
​
string
JWTScopeClaimName overides the key used for scope values in the JWT claims. By default the value is “scope”
​
string
JWTSigningMethod algorithm used to sign jwt token Allowed values: “, rsa, hmac, ecdsa.
​
boolean
JWTSkipKid when true we ingore using kid as the identity for a JWT token and instead use jwt_identity_base_field if it was set or fallback to sub JWT claim.
​
string
JWTSource Must either be a base64 encoded valid RSA/HMAC key or a url to a resource serving JWK, this key will then be used to validate inbound JWT and throttle them according to the centralised JWT options and fields set in the configuration.
​
integer
​
string
OrgID is overwritten - no point setting this
​
integer
SessionLifetime this is duration in seconds before the session key expires in redis. Example: If you want the session keys to be alive only 24 hours you can set this value to 86400 that we can break down to 60 * 60 * 24 = Total seconds in a day
​
boolean
StripAuthData ensures that any security tokens used for accessing APIs are stripped and not leaked to the upstream
​
string
​
string
Tags are named gateway nodes which tell gateway clusters whether to load an API or not. for example, to load the API in an ARA gateway, you might want to include an edge tag.
​
boolean
UseBasicAuth enables basic authentication
​
boolean
Enable Go Plugin Auth. Needs to be combined with “use_keyless:false”
​
boolean
UseKeylessAccess will switch off all key checking. Some analytics will still be recorded, but rate-limiting, quotas and security policies will not be possible (there is no session to attach requests to).
​
boolean
UseMutualTLSAuth enables mututal TLS authentication
​
boolean
UseOAuth2 enables oauth2 authorization
​
boolean
UseStandardAuth enables simple bearer token authentication

​
proxy

​
object
required
Proxy
​
string
required
TargetURL defines the target URL that the request should be proxied to.
​
boolean
CheckHostAgainstUptimeTests will check the hostname of the outbound request against the downtime list generated by the uptime test host checker. If the host is found, then it is skipped or removed from the load balancer. This is only valid if uptime tests for the api are enabled.
​
boolean
DisableStripSlash disables the stripping of the slash suffix from a URL. when true a request to http://foo.bar/baz/ will be retained. when false a request to http://foo.bar/baz/ will be matched to http://foo.bar/baz
​
boolean
EnableLoadBalancing enables Tyk’s round-robin loadbalancer. Tyk will ignore the TargetURL field, and rely on the hosts in the Targets list
​
string
ListenPath represents the path to listen on. e.g. /api or / or /httpbin. Any requests coming into the host, on the port that Tyk is configured to run on, that match this path will have the rules defined in the API Definition applied. Versioning assumes that different versions of an API will live on the same URL structure. If you are using URL-based versioning (e.g. /v1/function, /v2/function) then it is recommended to set up a separate non-versioned definition for each version as they are essentially separate APIs.
​
boolean
If PreserveHostHeader is set to true then the host header in the outbound request is retained to be the inbound hostname of the proxy.
​
object
ServiceDiscovery configures integration with an external service discovery system (for example Consul, etcd or Eureka) that the gateway queries to resolve the upstream target hosts at runtime.
​
integer
required
​
string
required
​
boolean
required
​
string
required
​
string
required
​
string
required
​
string
required
​
boolean
required
​
boolean
required
​
boolean
required
​
boolean
StripListenPath removes the inbound listen path in the outgoing request. e.g. http://acme.com/httpbin/get where httpbin is the listen path. The httpbin listen path which is used to identify the API loaded in Tyk is removed, and the outbound request would be http://httpbin.org/get
​
object
​
string
Path path on target , this does not include query parameters. example /myendpoint
​
string
Query url query string to add to target example check_limits=true
​
object
API a namespaced/name to the api definition resource that you are targetting
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
​
string
Targets defines a list of upstream host targets. Tyk will then round-robin load balance between these targets. EnableLoadBalancing must be set to true in order to take advantage of this feature.
​
object
Transport section exposes advanced transport level configurations such as minimum TLS version.
​
string
ProxyURL specifies custom forward proxy & port. e.g. http(s)://proxy.url:1234
​
string
SSLCipherSuites is an array of acceptable cipher suites. A list of allowed cipher suites can be found in the Go Crypto TLS package constants documentation https://golang.org/pkg/crypto/tls/#pkg-constants
​
boolean
SSLForceCommonNameCheck forces hostname validation against the certificate Common Name
​
boolean
SSLInsecureSkipVerify controls whether it is possible to use self-signed certificates when connecting to the upstream. This is applied to TykMakeHttpRequest & TykMakeBatchRequest in virtual endpoint middleware.
​
integer
SSLMinVersion defines the minimum TLS version the gateway will use to establish a connection to the upstream. 1.0: 769; 1.1: 770; 1.2: 771; 1.3: 772. Allowed values: 769, 770, 771, 772.

​
analytics_plugin

​
object
AnalyticsPlugin is used to configure analytics plugin which enables editing or removal of all parts of analytics records, raw request and responses recorded by Tyk at the gateway level
​
boolean
required
​
string
​
string

​
auth

​
object
​
string
required
​
string
​
string
​
object
​
string
required
​
integer
required
​
integer
required
​
string
required
​
string
required
​
string
required
​
boolean
​
boolean
​
boolean
​
boolean

​
auth_configs

​
object
Map of string keys to values.
​
object
​
string
required
​
string
​
string
​
object
​
string
required
​
integer
required
​
integer
required
​
string
required
​
string
required
​
string
required
​
boolean
​
boolean
​
boolean
​
boolean

​
cache_options

​
object
​
integer
required
CacheTimeout is the TTL for a cached object in seconds
​
boolean
CacheAllSafeRequests caches responses to (GET, HEAD, OPTIONS) requests overrides per-path cache settings in versions, applies across versions
​
string
CacheByHeaders allows header values to be used as part of the cache key
​
string
CacheControlTTLHeader is the response header which tells Tyk how long it is safe to cache the response for
​
integer
CacheOnlyResponseCodes is an array of response codes which are safe to cache. e.g. 404
​
boolean
EnableCache turns global cache middleware on or off. It is still possible to enable caching on a per-path basis by explicitly setting the endpoint cache middleware. see spec.version_data.versions.{VERSION}.extended_paths.cache[]
​
boolean
EnableUpstreamCacheControl instructs Tyk Cache to respect upstream cache control headers

​
contextRef

​
object
Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
CORS

​
object
​
boolean
AllowCredentials if true will allow cookies
​
string
AllowedHeaders are headers that are allowed within a request.
​
string
AllowedMethods is a list of methods to allow access via. Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
AllowedOrigins is a list of origin domains to allow access from.
​
boolean
Debug if true, this option produces log files for the CORS middleware
​
boolean
Enable when set to true it enables the cors middleware for the api
​
string
ExposedHeaders is a list of headers that are exposed back in the response.
​
integer
MaxAge is the maximum age of credentials
​
boolean
OptionsPassthrough allow CORS OPTIONS preflight request to be proxied directly to upstream, without authentication and rest of checks. This means that pre-flight requests generated by web-clients such as SwaggerUI or the Tyk Portal documentation system will be able to test the API using trial keys. If your service handles CORS natively, then enable this option.

​
custom_middleware

​
object
​
string
required
​
object
​
string
required
​
string
required
​
boolean
​
boolean
​
object
​
string
required
​
string
required
​
object
required
​
string
​
string
​
string
​
integer
​
object
​
string
required
​
string
required
​
boolean
​
boolean
​
object
​
string
required
​
string
required
​
boolean
​
boolean
​
object
​
string
required
​
string
required
​
boolean
​
boolean
​
object
​
string
required
​
string
required
​
boolean
​
boolean

​
definition

​
object
VersionDefinition is a struct that holds the version information for the API
​
string
required
​
string
required
​
string
​
boolean
​
boolean
​
string
​
boolean
Deprecated: use StripVersioningData instead.
​
boolean
​
string
​
object
Map of string keys to values.
​
string

​
event_handlers

​
object
​
object
required
Map of string keys to values.
​
object
​
object
required
MapStringInterfaceType represents a generic struct used as a map[string]interface{}. Since an arbitrary JSON fields defined as map[string]interface{} is not feasible to use as a Kubernetes CRD, unstructured.Unstructured type is used. Free-form object with arbitrary keys.
​
string
required

​
global_rate_limit

​
object
GlobalRateLimit is an API Level Global Rate Limit, which assesses all traffic coming into the API from all sources and ensures that the overall rate limit is not exceeded.
​
integer
required
Per represents a time window in seconds
​
integer
required
Rate represents the number of requests allowed within a specified time window (Per)

​
graphql

​
object
GraphQLConfig is the root config object for a GraphQL API.
​
boolean
required
Enabled indicates if GraphQL proxy should be enabled.
​
string
required
GraphQLExecutionMode is the mode to define how an api behaves. Allowed values: “, proxyOnly, executionEngine, supergraph, subgraph.
​
object
Engine holds the configuration for engine v2 and upwards.
​
object
required
​
object
required
MapStringInterfaceType represents a generic struct used as a map[string]interface{}. Since an arbitrary JSON fields defined as map[string]interface{} is not feasible to use as a Kubernetes CRD, unstructured.Unstructured type is used. Free-form object with arbitrary keys.
​
boolean
required
​
string
required
Allowed values: REST, GraphQL, Kafka.
​
string
required
​
object
required
​
string
required
​
string
required
​
object
required
​
boolean
required
​
string
required
​
string
required
​
string
required
​
object
GlobalHeaders for managing headers for UDG and all associated data sources
​
string
required
Key is the name of the request header
​
string
required
Value holds the value of the request header
​
string
​
object
Introspection holds the configuration for GraphQL Introspection
​
boolean
​
string
LastSchemaUpdate contains the date and time of the last triggered schema update to the upstream.
​
object
GraphQLPlayground is the Playground specific configuration.
​
boolean
required
Enabled indicates if the playground should be enabled.
​
string
required
Path sets the path on which the playground will be hosted if enabled.
​
object
Proxy holds the configuration for a proxy only api.
​
object
Map of string keys to values.
​
string
​
object
​
boolean
​
object
Map of string keys to values.
​
string
​
object
Map of string keys to values.
​
object
​
boolean
required
​
string
required
​
string
SubscriptionType is the subscription protocol to use for graphql subscriptions Allowed values: “, graphql-ws, graphql-transport-ws, sse.
​
object
​
boolean
required
​
string
Schema is the GraphQL Schema exposed by the GraphQL API/Upstream/Engine.
​
object
Subgraph holds the configuration for a GraphQL federation subgraph.
​
string
required
​
object
Supergraph holds the configuration for a GraphQL federation supergraph.
​
boolean
​
object
Map of string keys to values.
​
string
​
string
​
object
​
string
required
UUID v4 string (!not the same as _id of APIDefinition)
​
object
required
Map of string keys to values.
​
string
​
string
required
​
string
required
the schema definition language of the subgraph
​
string
required
The internal URL of the subgraph
​
string
UpdatedAt contains the date and time of the last update of a supergraph API.
​
object
TypeFieldConfigurations is a rule set of data source and mapping of a schema field.
​
object
required
​
string
required
Kind defines the unique identifier of the DataSource Kind needs to match to the Planner “DataSourceName” name Allowed values: GraphQLDataSource, HTTPJSONDataSource.
​
object
Config is the DataSource specific configuration object Each Planner needs to make sure to parse their Config Object correctly
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
string
​
string
​
string
​
object
​
integer
required
​
string
​
string
required
​
object
required
​
boolean
required
​
string
required
​
string
required
​
string
Version defines the version of the GraphQL config and engine to be used. Allowed values: 1, 2.

​
jwt_scope_to_policy_mapping

​
object
JWTScopeToPolicyMapping this is a mapping of scope value to policy id. If this is set then a scope value found in this map will make the mappend policy to be applied.
​
string

​
oauth_meta

​
object
​
string
required
AllowedAccessTypes are an array of allowable access types. Allowed values: authorization_code, refresh_token, password, client_credentials.
​
string
required
AllowedAuthorizeTypes is an array of allowable response_type parameters token or authorization code code. Choose token for client_credentials or implicit grant types. Allowed values: code, token.
​
string
Login form to handle user login.

​
pinned_public_keys

​
object
PinnedPublicKeys allows you to whitelist public keys used to generate certificates, so you will be protected in case an upstream certificate is compromised. Please use PinnedPublicKeysRefs if using cert-manager.
​
string

​
pinned_public_keys_refs

​
object
PinnedPublicKeysRefs allows you to specify public keys using k8s secret. It takes domain name as a key and secret name as a value.
​
string

​
response_processors

​
object
​
string
required

​
upstream_certificate_refs

​
object
UpstreamCertificateRefs is a map of domains and secret names that is used internally to obtain certificates from secrets in order to establish mTLS support for upstreams
​
string

​
upstream_certificates

​
object
UpstreamCertificates is a map of domains and certificate IDs that is used by the Tyk Gateway to provide mTLS support for upstreams
​
string

​
uptime_tests

​
object
UptimeTests is a struct that holds the uptime test information for the API
​
object
​
string
required
​
string
​
object
​
string
required
​
string
required
​
boolean
​
object
Map of string keys to values.
​
string
​
string
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
​
integer
A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.
​
object
​
integer
must have an expireAt TTL index set (http://docs.mongodb.org/manual/tutorial/expire-data/)
​
integer
​
object
​
integer
required
​
string
required
​
boolean
required
​
string
required
​
string
required
​
string
required
​
string
required
​
boolean
required
​
boolean
required
​
boolean
required

​
version_data

​
object
​
string
required
​
boolean
required
​
object
Map of string keys to values.
​
object
​
string
required
​
string
​
object
​
object
​
string
required
​
integer
required
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
integer
​
object
​
boolean
required
​
object
required
Map of string keys to values.
​
object
​
string
required
​
integer
required
​
string
required
​
object
required
Map of string keys to values.
​
string
​
string
required
​
string
List of paths which cache middleware should be enabled on
​
object
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
integer
required
ReturnToServiceAfter represents the time in seconds to return back to the service
​
integer
required
Samples defines the number of requests to base the ThresholdPercent on
​
string
required
ThresholdPercent is the percentage of requests that fail before breaker is tripped
​
boolean
​
object
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
object
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
integer
required
​
object
​
boolean
required
​
object
required
Map of string keys to values.
​
object
​
string
required
​
integer
required
​
string
required
​
object
required
Map of string keys to values.
​
string
​
string
required
​
object
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
object
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
object
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
integer
required
​
object
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
object
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
object
required
​
boolean
required
​
string
required
​
string
required
​
string
required
​
object
​
boolean
required
​
object
required
Map of string keys to values.
​
string
​
string
required
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
object
​
string
required
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
object
​
string
required
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
object
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
object
required
​
boolean
required
​
string
required
​
string
required
​
string
required
​
object
​
boolean
required
​
object
required
Map of string keys to values.
​
string
​
string
required
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
object
​
string
required
MatchPattern is a regular expression pattern to match the path
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
Path represents the endpoint listen path
​
string
RewriteTo is the target path on the upstream, or target URL we wish to rewrite to
​
object
RewriteToInternal serves as rewrite_to but used when rewriting to target internal api’s When rewrite_to and rewrite_to_internal are both provided then rewrite_to will take rewrite_to_internal
​
string
Path path on target , this does not include query parameters. example /myendpoint
​
string
Query url query string to add to target example check_limits=true
​
object
API a namespaced/name to the api definition resource that you are targetting
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
​
object
​
string
required
​
object
required
​
object
Map of string keys to values.
​
object
​
string
required
​
boolean
​
object
Map of string keys to values.
​
object
​
string
required
​
boolean
​
object
​
string
required
​
boolean
​
object
Map of string keys to values.
​
object
​
string
required
​
boolean
​
object
Map of string keys to values.
​
object
​
string
required
​
boolean
​
object
Map of string keys to values.
​
object
​
string
required
​
boolean
​
string
​
object
RewriteToInternal defines options that constructs a url that refers to an api that is loaded into the gateway.
​
string
Path path on target , this does not include query parameters. example /myendpoint
​
string
Query url query string to add to target example check_limits=true
​
object
API a namespaced/name to the api definition resource that you are targetting
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
​
object
​
integer
required
Allows override of default 422 Unprocessable Entity response code for validation errors.
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
object
required
Schema represents schema field that verifies user requests against a specified JSON schema and check that the data sent to your API by a consumer is in the right format. Free-form object with arbitrary keys.
​
boolean
​
object
​
string
required
​
string
required
​
string
required
HttpMethod represents HTTP request method Allowed values: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, CONNECT, TRACE.
​
string
required
​
boolean
required
​
string
required
​
boolean
required
​
object
​
boolean
required
​
object
required
Map of string keys to values.
​
object
​
string
required
​
integer
required
​
string
required
​
object
required
Map of string keys to values.
​
string
​
string
required
​
object
Map of string keys to values.
​
string
​
string
​
object
Map of string keys to values.
​
string
​
string
​
integer
​
boolean
​
string
​
object
​
string
​
string
​
string
​
boolean

​
TykStreamsApiDefinition

TykStreamsApiDefinitionSpec defines the desired state of TykStreamsApiDefinition

​
tykStreams

​
object
required
TykStreams provides storage information about Tyk Streams
​
object
required
ConfigmapRef provides information of configmap in which Tyk Streams is stored
​
string
required
KeyName is the key of configmap in which Tyk OAS doc is stored
​
string
required
Name is the name of configmap
​
string
Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource.

​
contextRef

​
object
Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
TykMcpProxyDefinition

TykMcpProxyDefinitionSpec defines the desired state of TykMcpProxyDefinition

​
tykMCP

​
object
required
TykMCP provides storage information about MCP proxy configuration
​
object
required
ConfigmapRef provides information of configmap in which MCP OAS document is stored
​
string
required
KeyName is the key of configmap in which Tyk OAS doc is stored
​
string
required
Name is the name of configmap
​
string
Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource.

​
contextRef

​
object
Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
SecurityPolicy

SecurityPolicySpec defines the desired state of SecurityPolicy

​
Top-Level Fields

​
boolean
required
Active must be set to true for Tyk to load the security policy into memory.
​
string
required
Name represents the name of the security policy as displayed in the Dashboard
​
string
required
State can be active, draft or deny active: All keys are active and new keys can be created. draft: All keys are active but no new keys can be created. deny: All keys are deactivated and no keys can be created. Allowed values: active, draft, deny.
​
string
MID (“_id”) is generated by Tyk once the resource is created. Do NOT fill this in.
​
boolean
​
boolean
​
string
If you are linking an existing Policy ID to a new YAML CRD, then fill in this ID field with the “_id” field. See policies.md readme for more info
​
boolean
IsInactive applies to the key itself. Allows enabling or disabling the policy without deleting it.
​
integer
KeyExpiresIn is the number of seconds till key expiry. For 1 hour is 3600. Default never expire or 0
​
integer
Max depth of a GraphQL query
​
string
OrgID is overwritten - no point setting this
​
integer
To be used in conjunction with “Rate”. Per seconds. 1 minute=60. 1 hour=3600 omit or “-1” for unlimited
​
integer
Value of Quota allowed, omit or “-1” for unlimited
​
integer
Value reset length, in seconds, omit or “-1” for unlimited
​
integer
Rate limit per X seconds (x=“Per”), omit or “-1” for unlimited
​
string
Custom tags to apply to the key, get transfered to the analytics
​
integer
If rate limited, how many seconds to retry a request for. omit or “-1” for unlimited
​
integer
Number of retries before returning error. omit or “-1” for unlimited

​
access_rights

​
object
Map of string keys to values.
​
object
AccessDefinition defines which versions of an API a key has access to
​
string
required
Name of the ApiDefinition resource to target
​
string
required
Namespace of the ApiDefinition resource to target
​
string
​
object
Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key.
​
string
required
​
string
required
​
object
AccessSpec defines what URLS a user has access to and what methods are enabled
​
string
required
​
string
required
​
string
APIID is the ID of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually.
​
string
APIName is the name of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually.
​
boolean
DisableIntrospection disables GraphQL introspection if it is set to True.
​
object
Endpoints is a collection of Endpoint.
​
object
EndpointMethods is a collection of EndpointMethod.
​
object
RateLimit holds rate limit configuration.
​
string
required
Per is the interval at which rate limit is enforced.
​
string
required
Rate is the allowed number of requests per interval.
​
object
Smoothing contains rate limit smoothing settings.
​
boolean
required
Enabled indicates if rate limit smoothing is active.
​
integer
Delay is the minimum time between rate limit changes (in seconds).
​
integer
Step is the increment/decrement for adjusting the rate limit.
​
integer
Threshold is the request rate above which smoothing is applied.
​
string
Trigger is the step factor determining when smoothing events trigger.
​
string
​
string
​
object
FieldAccessRights is array of depth limit settings per GraphQL APIs.
​
string
FieldName represents the name of the Query or Mutation which the limit applies to.
​
object
Limit specifies the numerical value of the limit.
​
integer
required
MaxQueryDepth represents the numerical value of the limit.
​
string
TypeName points to a type on which depth limit is set. It can be either Query (most common case) or Mutation
​
object
JSONRPCMethods defines per-JSON-RPC-method rate limits.
​
object
RateLimit holds rate limit configuration.
​
string
required
Per is the interval at which rate limit is enforced.
​
string
required
Rate is the allowed number of requests per interval.
​
object
Smoothing contains rate limit smoothing settings.
​
boolean
required
Enabled indicates if rate limit smoothing is active.
​
integer
Delay is the minimum time between rate limit changes (in seconds).
​
integer
Step is the increment/decrement for adjusting the rate limit.
​
integer
Threshold is the request rate above which smoothing is applied.
​
string
Trigger is the step factor determining when smoothing events trigger.
​
string
Name is the JSON-RPC method name (e.g., “tools/call”, “resources/read”).
​
object
JSONRPCMethodsAccessRights defines allow/block lists for JSON-RPC methods.
​
string
​
string
​
string
default:"ApiDefinition"
Kind represents the kind of the linked API Definition resource. It can be either “ApiDefinition” or “TykOasApiDefinition” (case sensitive way). By default, Kind is set to “ApiDefinition”. Allowed values: ApiDefinition, TykOasApiDefinition, TykStreamsApiDefinition, TykMcpProxyDefinition.
​
object
APILimit stores quota and rate limit on ACL level (per API)
​
integer
required
​
integer
required
​
integer
required
​
integer
required
​
integer
required
​
integer
required
​
integer
​
object
Smoothing contains rate limit smoothing settings.
​
boolean
required
Enabled indicates if rate limit smoothing is active.
​
integer
Delay is the minimum time between rate limit changes (in seconds).
​
integer
Step is the increment/decrement for adjusting the rate limit.
​
integer
Threshold is the request rate above which smoothing is applied.
​
string
Trigger is the step factor determining when smoothing events trigger.
​
object
MCPAccessRights defines allow/block lists for MCP tools, resources, and prompts.
​
object
AccessControlRules defines allow/block lists for access control.
​
string
​
string
​
object
AccessControlRules defines allow/block lists for access control.
​
string
​
string
​
object
AccessControlRules defines allow/block lists for access control.
​
string
​
string
​
object
MCPPrimitives defines per-primitive rate limits for MCP tools, resources, and prompts.
​
object
RateLimit holds rate limit configuration.
​
string
required
Per is the interval at which rate limit is enforced.
​
string
required
Rate is the allowed number of requests per interval.
​
object
Smoothing contains rate limit smoothing settings.
​
boolean
required
Enabled indicates if rate limit smoothing is active.
​
integer
Delay is the minimum time between rate limit changes (in seconds).
​
integer
Step is the increment/decrement for adjusting the rate limit.
​
integer
Threshold is the request rate above which smoothing is applied.
​
string
Trigger is the step factor determining when smoothing events trigger.
​
string
Name is the primitive name (tool name, resource URI, or prompt name).
​
string
Type is the MCP primitive type: “tool”, “resource”, or “prompt”. Allowed values: tool, resource, prompt.
​
object
Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key.
​
string
required
​
string
required
​
string

​
access_rights_array

​
object
AccessDefinition defines which versions of an API a key has access to
​
string
required
Name of the ApiDefinition resource to target
​
string
required
Namespace of the ApiDefinition resource to target
​
string
​
object
Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key.
​
string
required
​
string
required
​
object
AccessSpec defines what URLS a user has access to and what methods are enabled
​
string
required
​
string
required
​
string
APIID is the ID of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually.
​
string
APIName is the name of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually.
​
boolean
DisableIntrospection disables GraphQL introspection if it is set to True.
​
object
Endpoints is a collection of Endpoint.
​
object
EndpointMethods is a collection of EndpointMethod.
​
object
RateLimit holds rate limit configuration.
​
string
required
Per is the interval at which rate limit is enforced.
​
string
required
Rate is the allowed number of requests per interval.
​
object
Smoothing contains rate limit smoothing settings.
​
boolean
required
Enabled indicates if rate limit smoothing is active.
​
integer
Delay is the minimum time between rate limit changes (in seconds).
​
integer
Step is the increment/decrement for adjusting the rate limit.
​
integer
Threshold is the request rate above which smoothing is applied.
​
string
Trigger is the step factor determining when smoothing events trigger.
​
string
​
string
​
object
FieldAccessRights is array of depth limit settings per GraphQL APIs.
​
string
FieldName represents the name of the Query or Mutation which the limit applies to.
​
object
Limit specifies the numerical value of the limit.
​
integer
required
MaxQueryDepth represents the numerical value of the limit.
​
string
TypeName points to a type on which depth limit is set. It can be either Query (most common case) or Mutation
​
object
JSONRPCMethods defines per-JSON-RPC-method rate limits.
​
object
RateLimit holds rate limit configuration.
​
string
required
Per is the interval at which rate limit is enforced.
​
string
required
Rate is the allowed number of requests per interval.
​
object
Smoothing contains rate limit smoothing settings.
​
boolean
required
Enabled indicates if rate limit smoothing is active.
​
integer
Delay is the minimum time between rate limit changes (in seconds).
​
integer
Step is the increment/decrement for adjusting the rate limit.
​
integer
Threshold is the request rate above which smoothing is applied.
​
string
Trigger is the step factor determining when smoothing events trigger.
​
string
Name is the JSON-RPC method name (e.g., “tools/call”, “resources/read”).
​
object
JSONRPCMethodsAccessRights defines allow/block lists for JSON-RPC methods.
​
string
​
string
​
string
default:"ApiDefinition"
Kind represents the kind of the linked API Definition resource. It can be either “ApiDefinition” or “TykOasApiDefinition” (case sensitive way). By default, Kind is set to “ApiDefinition”. Allowed values: ApiDefinition, TykOasApiDefinition, TykStreamsApiDefinition, TykMcpProxyDefinition.
​
object
APILimit stores quota and rate limit on ACL level (per API)
​
integer
required
​
integer
required
​
integer
required
​
integer
required
​
integer
required
​
integer
required
​
integer
​
object
Smoothing contains rate limit smoothing settings.
​
boolean
required
Enabled indicates if rate limit smoothing is active.
​
integer
Delay is the minimum time between rate limit changes (in seconds).
​
integer
Step is the increment/decrement for adjusting the rate limit.
​
integer
Threshold is the request rate above which smoothing is applied.
​
string
Trigger is the step factor determining when smoothing events trigger.
​
object
MCPAccessRights defines allow/block lists for MCP tools, resources, and prompts.
​
object
AccessControlRules defines allow/block lists for access control.
​
string
​
string
​
object
AccessControlRules defines allow/block lists for access control.
​
string
​
string
​
object
AccessControlRules defines allow/block lists for access control.
​
string
​
string
​
object
MCPPrimitives defines per-primitive rate limits for MCP tools, resources, and prompts.
​
object
RateLimit holds rate limit configuration.
​
string
required
Per is the interval at which rate limit is enforced.
​
string
required
Rate is the allowed number of requests per interval.
​
object
Smoothing contains rate limit smoothing settings.
​
boolean
required
Enabled indicates if rate limit smoothing is active.
​
integer
Delay is the minimum time between rate limit changes (in seconds).
​
integer
Step is the increment/decrement for adjusting the rate limit.
​
integer
Threshold is the request rate above which smoothing is applied.
​
string
Trigger is the step factor determining when smoothing events trigger.
​
string
Name is the primitive name (tool name, resource URI, or prompt name).
​
string
Type is the MCP primitive type: “tool”, “resource”, or “prompt”. Allowed values: tool, resource, prompt.
​
object
Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key.
​
string
required
​
string
required
​
string

​
contextRef

​
object
Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
meta_data

​
object
LastUpdated string json:"last_updated"
​
string

​
partitions

​
object
​
boolean
​
boolean
​
boolean
​
boolean
​
boolean

​
APIDescription

APIDescriptionSpec defines the desired state of APIDescription

​
Top-Level Fields

​
string
AuthType displays as a badge next to the name of the API Allowed values: keyless, jwt, oauth, authToken.
​
string
Do not set Documentation. Use docs instead.
​
boolean
IsKeyless toggles visibility of the Request an API Key button. Use this when AuthType is keyless, jwt or oauth.
​
string
LongDescription can be markdown. It allows you to describe the capabilities of the API and is displayed just below the name and AuthType in the catalogue listing page.
​
string
Name is the title of the API that you wish to be published to the catalogue
​
string
PolicyID explicitly sets the policy_id to be published. We do not recommend that this value is set directly. Rather, use policyRef instead.
​
string
ShortDescription is a brief summary of the API shown in the portal catalogue. Note that it may not be rendered by the default portal templates.
​
boolean
Show toggles visibility of the API in the portal catalogue
​
string
default:"v2"
Version should always be v2 Allowed values: v2.

​
config

​
object
Config optionally overrides individual fields of the portal’s PortalConfig for this catalogue.
​
boolean
CatalogueLoginOnly limits access to catalogues for login users only.
​
object
DCROptions dynamic client registration options.
​
string
required
GrantTypes is an array of OAuth 2.0 grant type strings that the client can use at the token endpoint. Allowed values: client_credentials, authorization_code, refresh_token.
​
string
required
IDPHost is the fully qualified hostname of the Identity Provider. e.g. https://mysubdomain.eu.auth0.com
​
string
required
RegistrationEndpoint is the registration_endpoint as presented in the /.well-known/openid-configuration document.
​
string
required
TokenEndpointAuthMethod is an indicator of the requested authentication method for the token endpoint. “none”: The client is a public client and does not have a client secret. “client_secret_post”: The client uses the HTTP POST parameters “client_secret_basic”: The client uses HTTP Basic authentication Allowed values: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, none.
​
string
AccessToken represents an optional bearer token to authenticate with against the registration endpoint
​
string
Provider is an optional enum of the provider which allows Tyk to register clients outside the standard DCR spec and perform provider specific logic. If your provider is not in this list, please omit. Upon failure, submit a support ticket so that we may extend support for your provider. Allowed values: gluu, keycloak, okta.
​
string
ResponseTypes is an array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. Allowed values: code, token.
​
boolean
​
boolean
DisableLogin disables login on developer portal.If you do not want developers to be able to login, set this value to true. You can use this configuration option in the portal templates to display or hide the login form as well as disabling the actual login method.
​
boolean
DisableSignup stop developer sign-up to the portal.This will stop developers from being able to signup, they will need to be created manually, or assigned keys via the key management API.
​
string
​
boolean
EnableDCR activates dynamic client registration.
​
boolean
EnableMultiSelection enables subscribing to multiple APIs with single key.User will be able subscript any combination of exposed catalogues of the same authentication type
​
string
Set by the server. DO NOT set this field it is read only.
​
string
KeyRequestFields is a slice of fields which are asked of the portal developer when requesting an api key
​
object
​
object
required
​
object
required
​
string
required
​
boolean
required
​
boolean
required
​
string
required
​
string
required
​
object
required
​
string
required
​
boolean
required
​
boolean
required
​
string
required
​
string
required
​
object
required
​
string
required
​
boolean
required
​
boolean
required
​
string
required
​
string
required
​
string
required
​
string
required
​
integer
OAuthUsageLimit is the maximum permitted number of OAuth clients
​
string
OrgID is the organization ID
​
boolean
Override overides global settings. These Catalogue settings are currently being overwritten by the Global Catalogue settings. Toggle the checkbox below to override them for this Catalogue.
​
boolean
RedirectOnKeyRequest redirects key requests. WHen set to true it will redirect key requests to the url specified in RedirectTo field
​
string
RedirectTo is a url used to redirect key requests
​
boolean
RequireKeyApproval requires reviewing of all key requests before approving them. By default developers will auto-enroll into an API and be given an API key. If you wish to review key requests before giving developers access to the API, enable this option and you will manually need to approve them in the ‘Key requests’ section of the dashboard.
​
boolean
SecureKeyApproval enables Secure key approval.By default, API keys when approved are sent in an email to the Developer. By enabling this option, the Developer will instead receive a link where they can go to generate the API key securely
​
string
SignUpFields is a slice of fields which are asked of the portal developer when they register for an account

​
contextRef

​
object
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
docs

​
object
​
string
required
Allowed values: swagger, swagger_custom_url, graphql.
​
string

​
fields

​
object
Fields is a generic map of key:value pairs. You may wish to use this to tag a catalogue as type:internal or type:public Then apply logic at the template layer to dynamically display catalogue apis to different user types.
​
string

​
policyRef

​
object
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
OperatorContext

OperatorContextSpec defines the desired state of OperatorContext

​
env

​
object
Env is the values of the admin api endpoint that the operator will use to reconcile resources
​
string
​
object
​
integer
​
integer
​
boolean
​
string
OperatorContextMode is the mode to which the admin api binding is done values are ce for community edition and pro for dashboard Allowed values: ce, pro.
​
string
​
string
​
string
​
string

​
secretRef

​
object
Reference to k8s secret resource that we load environment from.
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
PortalAPICatalogue

PortalAPICatalogueSpec defines the desired state of PortalAPICatalogue

​
Top-Level Fields

​
string
Email is Catalogue owner email address.Catalogue owner will be notified at this email address when an API subscription request is submitted or granted
​
string
OrgID is the organization ID

​
apis

​
object
APIDescriptionList is a list of PortalCatalogueDescription published on this PortalAPICatalogue
​
object
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
​
string
AuthType displays as a badge next to the name of the API Allowed values: keyless, jwt, oauth, authToken.
​
object
Config optionally overrides individual fields of the portal’s PortalConfig for this catalogue.
​
boolean
CatalogueLoginOnly limits access to catalogues for login users only.
​
object
DCROptions dynamic client registration options.
​
string
required
GrantTypes is an array of OAuth 2.0 grant type strings that the client can use at the token endpoint. Allowed values: client_credentials, authorization_code, refresh_token.
​
string
required
IDPHost is the fully qualified hostname of the Identity Provider. e.g. https://mysubdomain.eu.auth0.com
​
string
required
RegistrationEndpoint is the registration_endpoint as presented in the /.well-known/openid-configuration document.
​
string
required
TokenEndpointAuthMethod is an indicator of the requested authentication method for the token endpoint. “none”: The client is a public client and does not have a client secret. “client_secret_post”: The client uses the HTTP POST parameters “client_secret_basic”: The client uses HTTP Basic authentication Allowed values: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, none.
​
string
AccessToken represents an optional bearer token to authenticate with against the registration endpoint
​
string
Provider is an optional enum of the provider which allows Tyk to register clients outside the standard DCR spec and perform provider specific logic. If your provider is not in this list, please omit. Upon failure, submit a support ticket so that we may extend support for your provider. Allowed values: gluu, keycloak, okta.
​
string
ResponseTypes is an array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. Allowed values: code, token.
​
boolean
​
boolean
DisableLogin disables login on developer portal.If you do not want developers to be able to login, set this value to true. You can use this configuration option in the portal templates to display or hide the login form as well as disabling the actual login method.
​
boolean
DisableSignup stop developer sign-up to the portal.This will stop developers from being able to signup, they will need to be created manually, or assigned keys via the key management API.
​
string
​
boolean
EnableDCR activates dynamic client registration.
​
boolean
EnableMultiSelection enables subscribing to multiple APIs with single key.User will be able subscript any combination of exposed catalogues of the same authentication type
​
string
Set by the server. DO NOT set this field it is read only.
​
string
KeyRequestFields is a slice of fields which are asked of the portal developer when requesting an api key
​
object
​
object
required
​
object
required
​
string
required
​
boolean
required
​
boolean
required
​
string
required
​
string
required
​
object
required
​
string
required
​
boolean
required
​
boolean
required
​
string
required
​
string
required
​
object
required
​
string
required
​
boolean
required
​
boolean
required
​
string
required
​
string
required
​
string
required
​
string
required
​
integer
OAuthUsageLimit is the maximum permitted number of OAuth clients
​
string
OrgID is the organization ID
​
boolean
Override overides global settings. These Catalogue settings are currently being overwritten by the Global Catalogue settings. Toggle the checkbox below to override them for this Catalogue.
​
boolean
RedirectOnKeyRequest redirects key requests. WHen set to true it will redirect key requests to the url specified in RedirectTo field
​
string
RedirectTo is a url used to redirect key requests
​
boolean
RequireKeyApproval requires reviewing of all key requests before approving them. By default developers will auto-enroll into an API and be given an API key. If you wish to review key requests before giving developers access to the API, enable this option and you will manually need to approve them in the ‘Key requests’ section of the dashboard.
​
boolean
SecureKeyApproval enables Secure key approval.By default, API keys when approved are sent in an email to the Developer. By enabling this option, the Developer will instead receive a link where they can go to generate the API key securely
​
string
SignUpFields is a slice of fields which are asked of the portal developer when they register for an account
​
object
​
string
required
Allowed values: swagger, swagger_custom_url, graphql.
​
string
​
string
Do not set Documentation. Use docs instead.
​
object
Fields is a generic map of key:value pairs. You may wish to use this to tag a catalogue as type:internal or type:public Then apply logic at the template layer to dynamically display catalogue apis to different user types.
​
string
​
boolean
IsKeyless toggles visibility of the Request an API Key button. Use this when AuthType is keyless, jwt or oauth.
​
string
LongDescription can be markdown. It allows you to describe the capabilities of the API and is displayed just below the name and AuthType in the catalogue listing page.
​
string
Name is the title of the API that you wish to be published to the catalogue
​
string
PolicyID explicitly sets the policy_id to be published. We do not recommend that this value is set directly. Rather, use policyRef instead.
​
object
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.
​
string
ShortDescription is a brief summary of the API shown in the portal catalogue. Note that it may not be rendered by the default portal templates.
​
boolean
Show toggles visibility of the API in the portal catalogue
​
string
default:"v2"
Version should always be v2 Allowed values: v2.

​
contextRef

​
object
Context is reference to OperatorContext resource. Set this if you want to target a specific OperatorContext. When omitted default OperatorContext is used.
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
PortalConfig

PortalConfigSpec defines the desired state of PortalConfig

​
Top-Level Fields

​
boolean
CatalogueLoginOnly limits access to catalogues for login users only.
​
boolean
​
boolean
DisableLogin disables login on developer portal.If you do not want developers to be able to login, set this value to true. You can use this configuration option in the portal templates to display or hide the login form as well as disabling the actual login method.
​
boolean
DisableSignup stop developer sign-up to the portal.This will stop developers from being able to signup, they will need to be created manually, or assigned keys via the key management API.
​
string
​
boolean
EnableDCR activates dynamic client registration.
​
boolean
EnableMultiSelection enables subscribing to multiple APIs with single key.User will be able subscript any combination of exposed catalogues of the same authentication type
​
string
Set by the server. DO NOT set this field it is read only.
​
string
KeyRequestFields is a slice of fields which are asked of the portal developer when requesting an api key
​
integer
OAuthUsageLimit is the maximum permitted number of OAuth clients
​
string
OrgID is the organization ID
​
boolean
Override overides global settings. These Catalogue settings are currently being overwritten by the Global Catalogue settings. Toggle the checkbox below to override them for this Catalogue.
​
boolean
RedirectOnKeyRequest redirects key requests. WHen set to true it will redirect key requests to the url specified in RedirectTo field
​
string
RedirectTo is a url used to redirect key requests
​
boolean
RequireKeyApproval requires reviewing of all key requests before approving them. By default developers will auto-enroll into an API and be given an API key. If you wish to review key requests before giving developers access to the API, enable this option and you will manually need to approve them in the ‘Key requests’ section of the dashboard.
​
boolean
SecureKeyApproval enables Secure key approval.By default, API keys when approved are sent in an email to the Developer. By enabling this option, the Developer will instead receive a link where they can go to generate the API key securely
​
string
SignUpFields is a slice of fields which are asked of the portal developer when they register for an account

​
contextRef

​
object
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.

​
dcr_options

​
object
DCROptions dynamic client registration options.
​
string
required
GrantTypes is an array of OAuth 2.0 grant type strings that the client can use at the token endpoint. Allowed values: client_credentials, authorization_code, refresh_token.
​
string
required
IDPHost is the fully qualified hostname of the Identity Provider. e.g. https://mysubdomain.eu.auth0.com
​
string
required
RegistrationEndpoint is the registration_endpoint as presented in the /.well-known/openid-configuration document.
​
string
required
TokenEndpointAuthMethod is an indicator of the requested authentication method for the token endpoint. “none”: The client is a public client and does not have a client secret. “client_secret_post”: The client uses the HTTP POST parameters “client_secret_basic”: The client uses HTTP Basic authentication Allowed values: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, none.
​
string
AccessToken represents an optional bearer token to authenticate with against the registration endpoint
​
string
Provider is an optional enum of the provider which allows Tyk to register clients outside the standard DCR spec and perform provider specific logic. If your provider is not in this list, please omit. Upon failure, submit a support ticket so that we may extend support for your provider. Allowed values: gluu, keycloak, okta.
​
string
ResponseTypes is an array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. Allowed values: code, token.

​
mail_options

​
object
​
object
required
​
object
required
​
string
required
​
boolean
required
​
boolean
required
​
string
required
​
string
required
​
object
required
​
string
required
​
boolean
required
​
boolean
required
​
string
required
​
string
required
​
object
required
​
string
required
​
boolean
required
​
boolean
required
​
string
required
​
string
required
​
string
required
​
string
required

​
SubGraph

SubGraphSpec defines the desired state of SubGraph

​
Top-Level Fields

​
string
required
​
string
required

​
SuperGraph

SuperGraphSpec defines the desired state of SuperGraph

​
Top-Level Fields

​
string
​
string

​
subgraph_refs

​
object
required
​
string
required
k8s resource name
​
string
The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled.