> ## Documentation Index > Fetch the complete documentation index at: https://tyk.io/docs/llms.txt > Use this file to discover all available pages before exploring further. # Tyk Operator CRD Reference > Field reference for every Tyk Operator Custom Resource Definition (CRD). This page lists the fields of every Tyk Operator Custom Resource under its `spec`. Field names use dot notation for nested objects (`proxy.target_url`), `[]` for list items (`tags[]`), and `.{key}` for map entries (`auth_configs.{key}`). Within each group, required fields are listed first. Read-only `status` fields are not listed. ## TykOasApiDefinition TykOasApiDefinitionSpec defines the desired state of TykOasApiDefinition ### Top-Level Fields Categories serve as identifiers for the API definitions, subsequently enabling the filtering of API listings based on these categories. ### tykOAS TykOAS provides storage information about Tyk OAS ConfigmapRef provides information of configmap in which Tyk OAS is stored KeyName is the key of configmap in which Tyk OAS doc is stored Name is the name of configmap Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource. ### certificatePinning CertificatePinning contains the configuration related to certificate pinning. It is possible to set Kubernetes secrets containing certificates. It is used to set `upstream.certificatePinning` in Tyk OAS API Definition. Enabled is a boolean flag, if set to `true`, it enables certificate pinning for the API. Tyk classic API definition: `certificate_pinning_disabled` DomainToPublicKeysMapping maintains the mapping of domain to pinned public keys. Tyk classic API definition: `pinned_public_keys` Domain contains the domain name. PublicKeyRefs holds a list of Kubernetes secret names that reside in the same namespace as current TykOasApiDefinition resource. The secret needs to be a type of TLS secret where the pinned public key is stored in `tls.crt` field. Each secret must contain a public key associated with the specified domain name. **NOTE** If you want to continue using secrets that are already created on Tyk Dashboard, specify their IDs in `publicKeys` field of TykOasApiDefinition CR. And then, Tyk Operator will merge this array which is specified through `publicKeys` field with new Tyk Secrets which will be created based on Kubernetes secrets defined in `publicKeyRefs`. PublicKeys contains a list of the public keys IDs pinned to the domain name. It only accepts Tyk IDs of the public keys. If you have Kubernetes secrets containing public keys of the domain, please use `publicKeysRefs` field instead of this one. As this one only works with already existing public keys on Tyk Dashboard. ### clientCertificate ClientCertificate is used to configure client certificates settings needed for MTLS connection between Tyk and client. It is used to set `server.clientCertificate` field of Tyk OAS API Allowlist stores list of k8s secret names storing client certificates Enabled activates mTLS for the API. ### contextRef Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### customDomain CustomDomain is the domain to bind this API to. This enforces domain matching for client requests. Tyk classic API definition: `domain` Enabled allow/disallow the usage of the domain. Name is the name of the domain. Certificates defines a field for specifying certificate IDs that the Tyk can utilise to dynamically load certificates for your custom domain. Tyk classic API definition: `certificates` CertificatesRef defines a field for specifying certificates through Kubernetes secrets. Secrets need to be installed within the namespace of the TykOasApiDefinition resource. ### jwtAuth JwtAuth holds the configuration for the JWT middleware. DefaultPolicies is a list of policies specified using their name and namespace. k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. Scopes holds the scope to policy mappings for a claim name. ClaimName contains the claim name. ScopeToPolicyMapping contains the mappings of scopes to policy IDs. PolicyRef contains the referenced policy based on the name/namespace. k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. Scope contains the scope name. ### mutualTLS MutualTLS represents the configuration for an Upstream mTLS. Enabled indicates if MTLS should be enabled or not. DomainToCertificateMapping contains the configuration for an upstream server domain. Domain refers to the domain name of an upstream server. Certificate references to Tyk cert ID CertificateRef references the secret containing the domain's SSL Certificate. ### upstreamRequestSigning UpstreamRequestSigning configures HMAC-based request signing for upstream requests. When enabled, it ensures requests are signed before being sent to the upstream service using hmac-sha256 algorithm. Algorithm for request signing. For Certificate, it can rsa-sha256. For Secret, it can be any of hmac-sha1, hmac-sha256, hmac-sha384, hmac-sha512. **Allowed values:** `hmac-sha1`, `hmac-sha256`, `hmac-sha384`, `hmac-sha512`, `rsa-sha256`. CertificateRef references the secret containing SSL Certificate. keyid is mandatory if algorithm is hmac type SecretRef references HMAC secret KeyName is the key of secret in which Tyk OAS doc is stored Name is the name of the secret Namespace is the namespace of secret. If Namespace is not provided, we assume that the secret is in the same namespace as TykOasApiDefinition resource. ### versioning Versioning provides versioning information about this OAS API Enabled is a boolean flag, if set to true it will enable versioning of the API. Default contains the default version name if a request is issued without a version. FallbackToDefault specifies that the default version of the OAS API should be used if the requested version does not exist." Key contains the name of the key to check for versioning information. Location contains versioning location information. It can be one of the following: header, url-param, url. **Allowed values:** `header`, `url-param`, `url`. Name contains the name of the version. StripVersioningData if enabled, specifies that the API responses will be stripped of versioning data. UrlVersioningPattern configure with a regex that matches the versioning identifier format in your URLs. This is essential when using stripVersioningData and fallbackToDefault with location=url." Versions contains a list of versions that map to individual API IDs. Name contains the name of the referenced TykOasApiDefinition. TykOasApiDefinitionRef references a TykOasApiDefinition Name and Namespace. k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## ApiDefinition APIDefinitionSpec represents the configuration for a single proxied API and it's versions. ### Top-Level Fields APIProtocol is the network transport protocol supported by the gateway **Allowed values:** \`\`, `h2c`, `tcp`, `tls`, `http`, `https`. Active specifies if the api is enabled or not AllowedIPs is a list of IP address that are whitelisted.When this is provided all IP address that is not on this list will be blocked and a 403 http status will be returned. The IP address can be IPv4 or IPv6.IP in CIDR notation is also supported. Only set this field if you are referring to an existing API def. The Operator will use this APIID to link the CR with the API in Tyk Note: The values in the CR will become the new source of truth, overriding the existing API Definition BaseIdentityProvidedBy sets Base Identity Provider for situation when multiple authentication mechanisms are used **Allowed values:** `auth_token`, `hmac_key`, `basic_auth_user`, `jwt_claim`, `oidc_user`, `oauth_key`. BlacklistedIPs is a list of IP address that will be blacklisted.This means if origin IP matches any IP in this list a 403 http status code will be returned. The IP address can be IPv4 or IPv6. IP in CIDR notation is also supported. CertificateSecretNames represents the names of the secrets that the controller should look for in the current namespace which contain the certificates. Certificates is a list of Tyk Certificate IDs. e.g. orgid+fingerprint. Use CertificateSecretNames if using cert-manager ConfigData can be used to pass custom attributes (a JSON object) into your middleware, such as a virtual endpoint or header transform. Free-form object with arbitrary keys. DisableQuota allows you to disable quota middleware in a given API Definition. DisableRateLimit allows you to disable rate limits in a given API Definition. DoNotTrack disables endpoint tracking for this API Domain represents a custom host header that the gateway will listen on for this API EnableContextVars extracts request context variables from the start of the middleware chain. Set this to true to make them available to your transforms. Context Variables are available in the url rewriter, modify headers and body transforms. EnableDetailedRecording instructs Tyk store the inbound request and outbound response data in HTTP Wire format as part of the Analytics data EnableIPBlacklisting activates the ip blacklisting middleware. EnableIPWhiteListing activates the ip whitelisting middleware. EnableJWT set JWT as the access method for this API. For server use only, do not use Internal tells Tyk Gateway that this is a virtual API. It can only be routed to from other APIs. JWTClientIDBaseField is the name of the field on JWT claim to use for client id. This field is mutually exclusive to jwt\_identity\_base\_field, meaning you can only set/use one and jwt\_identity\_base\_field takes precedence when both are set. JWTDefaultPolicies is a list of policies that will be used when base policy can't be extracted from the JWT token. When this list is provided the first element will be used as the base policy while the rest of elements will be applied. JWTExpiresAtValidationSkew adds validation for expired at JWT claim. Given now = current unix time skew = jwt\_expires\_at\_validation\_skew exp = expired at If exp > (now - skew) then validation will fail with "token has expired" JWTIdentityBaseField Identifies the user or identity to be used in the Claims of the JWT. This will fallback to sub if not found. This field forms the basis of a new “virtual” token that gets used after validation. It means policy attributes are carried forward through Tyk for attribution purposes. JWTIssuedAtValidationSkew adds validation for issued at JWT claim. Given now = current unix time skew = jwt\_issued\_at\_validation\_skew iat = the issued at jwt claim If iat > (now + skew) then validation will fail with "token used before issued" JWTNotBeforeValidationSkew adds validation for not before JWT claim. Given now = current unix time skew = jwt\_not\_before\_validation\_skew nbf = the not before jwt claim If nbf > (now + skew) then validation will fail with "token is not valid yet" JWTPolicyFieldName The policy ID to apply to the virtual token generated for a JWT JWTScopeClaimName overides the key used for scope values in the JWT claims. By default the value is "scope" JWTSigningMethod algorithm used to sign jwt token **Allowed values:** \`\`, `rsa`, `hmac`, `ecdsa`. JWTSkipKid when true we ingore using kid as the identity for a JWT token and instead use jwt\_identity\_base\_field if it was set or fallback to sub JWT claim. JWTSource Must either be a base64 encoded valid RSA/HMAC key or a url to a resource serving JWK, this key will then be used to validate inbound JWT and throttle them according to the centralised JWT options and fields set in the configuration. OrgID is overwritten - no point setting this SessionLifetime this is duration in seconds before the session key expires in redis. Example: If you want the session keys to be alive only 24 hours you can set this value to 86400 that we can break down to 60 \* 60 \* 24 = Total seconds in a day StripAuthData ensures that any security tokens used for accessing APIs are stripped and not leaked to the upstream Tags are named gateway nodes which tell gateway clusters whether to load an API or not. for example, to load the API in an ARA gateway, you might want to include an `edge` tag. UseBasicAuth enables basic authentication Enable Go Plugin Auth. Needs to be combined with "use\_keyless:false" UseKeylessAccess will switch off all key checking. Some analytics will still be recorded, but rate-limiting, quotas and security policies will not be possible (there is no session to attach requests to). UseMutualTLSAuth enables mututal TLS authentication UseOAuth2 enables oauth2 authorization UseStandardAuth enables simple bearer token authentication ### proxy Proxy TargetURL defines the target URL that the request should be proxied to. CheckHostAgainstUptimeTests will check the hostname of the outbound request against the downtime list generated by the uptime test host checker. If the host is found, then it is skipped or removed from the load balancer. This is only valid if uptime tests for the api are enabled. DisableStripSlash disables the stripping of the slash suffix from a URL. when `true` a request to [http://foo.bar/baz/](http://foo.bar/baz/) will be retained. when `false` a request to [http://foo.bar/baz/](http://foo.bar/baz/) will be matched to [http://foo.bar/baz](http://foo.bar/baz) EnableLoadBalancing enables Tyk's round-robin loadbalancer. Tyk will ignore the TargetURL field, and rely on the hosts in the Targets list ListenPath represents the path to listen on. e.g. `/api` or `/` or `/httpbin`. Any requests coming into the host, on the port that Tyk is configured to run on, that match this path will have the rules defined in the API Definition applied. Versioning assumes that different versions of an API will live on the same URL structure. If you are using URL-based versioning (e.g. /v1/function, /v2/function) then it is recommended to set up a separate non-versioned definition for each version as they are essentially separate APIs. If PreserveHostHeader is set to true then the host header in the outbound request is retained to be the inbound hostname of the proxy. ServiceDiscovery configures integration with an external service discovery system (for example Consul, etcd or Eureka) that the gateway queries to resolve the upstream target hosts at runtime. StripListenPath removes the inbound listen path in the outgoing request. e.g. [http://acme.com/httpbin/get](http://acme.com/httpbin/get) where `httpbin` is the listen path. The `httpbin` listen path which is used to identify the API loaded in Tyk is removed, and the outbound request would be [http://httpbin.org/get](http://httpbin.org/get) Path path on target , this does not include query parameters. example /myendpoint Query url query string to add to target example check\_limits=true API a namespaced/name to the api definition resource that you are targetting k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. Targets defines a list of upstream host targets. Tyk will then round-robin load balance between these targets. EnableLoadBalancing must be set to true in order to take advantage of this feature. Transport section exposes advanced transport level configurations such as minimum TLS version. ProxyURL specifies custom forward proxy & port. e.g. `http(s)://proxy.url:1234` SSLCipherSuites is an array of acceptable cipher suites. A list of allowed cipher suites can be found in the Go Crypto TLS package constants documentation [https://golang.org/pkg/crypto/tls/#pkg-constants](https://golang.org/pkg/crypto/tls/#pkg-constants) SSLForceCommonNameCheck forces hostname validation against the certificate Common Name SSLInsecureSkipVerify controls whether it is possible to use self-signed certificates when connecting to the upstream. This is applied to `TykMakeHttpRequest` & `TykMakeBatchRequest` in virtual endpoint middleware. SSLMinVersion defines the minimum TLS version the gateway will use to establish a connection to the upstream. 1.0: 769; 1.1: 770; 1.2: 771; 1.3: 772. **Allowed values:** `769`, `770`, `771`, `772`. ### analytics\_plugin AnalyticsPlugin is used to configure analytics plugin which enables editing or removal of all parts of analytics records, raw `request` and responses recorded by Tyk at the gateway level ### auth ### auth\_configs Map of string keys to values. ### cache\_options CacheTimeout is the TTL for a cached object in seconds CacheAllSafeRequests caches responses to (GET, HEAD, OPTIONS) requests overrides per-path cache settings in versions, applies across versions CacheByHeaders allows header values to be used as part of the cache key CacheControlTTLHeader is the response header which tells Tyk how long it is safe to cache the response for CacheOnlyResponseCodes is an array of response codes which are safe to cache. e.g. 404 EnableCache turns global cache middleware on or off. It is still possible to enable caching on a per-path basis by explicitly setting the endpoint cache middleware. see `spec.version_data.versions.{VERSION}.extended_paths.cache[]` EnableUpstreamCacheControl instructs Tyk Cache to respect upstream cache control headers ### contextRef Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### CORS AllowCredentials if true will allow cookies AllowedHeaders are headers that are allowed within a request. AllowedMethods is a list of methods to allow access via. **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. AllowedOrigins is a list of origin domains to allow access from. Debug if true, this option produces log files for the CORS middleware Enable when set to true it enables the cors middleware for the api ExposedHeaders is a list of headers that are exposed back in the response. MaxAge is the maximum age of credentials OptionsPassthrough allow CORS OPTIONS preflight request to be proxied directly to upstream, without authentication and rest of checks. This means that pre-flight requests generated by web-clients such as SwaggerUI or the Tyk Portal documentation system will be able to test the API using trial keys. If your service handles CORS natively, then enable this option. ### custom\_middleware ### definition VersionDefinition is a struct that holds the version information for the API Deprecated: use StripVersioningData instead. Map of string keys to values. ### event\_handlers Map of string keys to values. MapStringInterfaceType represents a generic struct used as a map\[string]interface\{}. Since an arbitrary JSON fields defined as map\[string]interface\{} is not feasible to use as a Kubernetes CRD, unstructured.Unstructured type is used. Free-form object with arbitrary keys. ### global\_rate\_limit GlobalRateLimit is an API Level Global Rate Limit, which assesses all traffic coming into the API from all sources and ensures that the overall rate limit is not exceeded. Per represents a time window in seconds Rate represents the number of requests allowed within a specified time window (Per) ### graphql GraphQLConfig is the root config object for a GraphQL API. Enabled indicates if GraphQL proxy should be enabled. GraphQLExecutionMode is the mode to define how an api behaves. **Allowed values:** \`\`, `proxyOnly`, `executionEngine`, `supergraph`, `subgraph`. Engine holds the configuration for engine v2 and upwards. MapStringInterfaceType represents a generic struct used as a map\[string]interface\{}. Since an arbitrary JSON fields defined as map\[string]interface\{} is not feasible to use as a Kubernetes CRD, unstructured.Unstructured type is used. Free-form object with arbitrary keys. **Allowed values:** `REST`, `GraphQL`, `Kafka`. GlobalHeaders for managing headers for UDG and all associated data sources Key is the name of the request header Value holds the value of the request header Introspection holds the configuration for GraphQL Introspection LastSchemaUpdate contains the date and time of the last triggered schema update to the upstream. GraphQLPlayground is the Playground specific configuration. Enabled indicates if the playground should be enabled. Path sets the path on which the playground will be hosted if enabled. Proxy holds the configuration for a proxy only api. Map of string keys to values. Map of string keys to values. Map of string keys to values. SubscriptionType is the subscription protocol to use for graphql subscriptions **Allowed values:** \`\`, `graphql-ws`, `graphql-transport-ws`, `sse`. Schema is the GraphQL Schema exposed by the GraphQL API/Upstream/Engine. Subgraph holds the configuration for a GraphQL federation subgraph. Supergraph holds the configuration for a GraphQL federation supergraph. Map of string keys to values. UUID v4 string (!not the same as \_id of APIDefinition) Map of string keys to values. the schema definition language of the subgraph The internal URL of the subgraph UpdatedAt contains the date and time of the last update of a supergraph API. TypeFieldConfigurations is a rule set of data source and mapping of a schema field. Kind defines the unique identifier of the DataSource Kind needs to match to the Planner "DataSourceName" name **Allowed values:** `GraphQLDataSource`, `HTTPJSONDataSource`. Config is the DataSource specific configuration object Each Planner needs to make sure to parse their Config Object correctly HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. Version defines the version of the GraphQL config and engine to be used. **Allowed values:** `1`, `2`. ### jwt\_scope\_to\_policy\_mapping JWTScopeToPolicyMapping this is a mapping of scope value to policy id. If this is set then a scope value found in this map will make the mappend policy to be applied. ### oauth\_meta AllowedAccessTypes are an array of allowable access types. **Allowed values:** `authorization_code`, `refresh_token`, `password`, `client_credentials`. AllowedAuthorizeTypes is an array of allowable `response_type` parameters `token` or authorization code `code`. Choose token for client\_credentials or implicit grant types. **Allowed values:** `code`, `token`. Login form to handle user login. ### pinned\_public\_keys PinnedPublicKeys allows you to whitelist public keys used to generate certificates, so you will be protected in case an upstream certificate is compromised. Please use PinnedPublicKeysRefs if using cert-manager. ### pinned\_public\_keys\_refs PinnedPublicKeysRefs allows you to specify public keys using k8s secret. It takes domain name as a key and secret name as a value. ### response\_processors ### upstream\_certificate\_refs UpstreamCertificateRefs is a map of domains and secret names that is used internally to obtain certificates from secrets in order to establish mTLS support for upstreams ### upstream\_certificates UpstreamCertificates is a map of domains and certificate IDs that is used by the Tyk Gateway to provide mTLS support for upstreams ### uptime\_tests UptimeTests is a struct that holds the uptime test information for the API Map of string keys to values. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years. must have an expireAt TTL index set ([http://docs.mongodb.org/manual/tutorial/expire-data/](http://docs.mongodb.org/manual/tutorial/expire-data/)) ### version\_data Map of string keys to values. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. Map of string keys to values. Map of string keys to values. List of paths which cache middleware should be enabled on HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. ReturnToServiceAfter represents the time in seconds to return back to the service Samples defines the number of requests to base the ThresholdPercent on ThresholdPercent is the percentage of requests that fail before breaker is tripped HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. Map of string keys to values. Map of string keys to values. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. Map of string keys to values. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. Map of string keys to values. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. MatchPattern is a regular expression pattern to match the path HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. Path represents the endpoint listen path RewriteTo is the target path on the upstream, or target URL we wish to rewrite to RewriteToInternal serves as rewrite\_to but used when rewriting to target internal api's When rewrite\_to and rewrite\_to\_internal are both provided then rewrite\_to will take rewrite\_to\_internal Path path on target , this does not include query parameters. example /myendpoint Query url query string to add to target example check\_limits=true API a namespaced/name to the api definition resource that you are targetting k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. Map of string keys to values. Map of string keys to values. Map of string keys to values. Map of string keys to values. Map of string keys to values. RewriteToInternal defines options that constructs a url that refers to an api that is loaded into the gateway. Path path on target , this does not include query parameters. example /myendpoint Query url query string to add to target example check\_limits=true API a namespaced/name to the api definition resource that you are targetting k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. Allows override of default 422 Unprocessable Entity response code for validation errors. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. Schema represents schema field that verifies user requests against a specified JSON schema and check that the data sent to your API by a consumer is in the right format. Free-form object with arbitrary keys. HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. Map of string keys to values. Map of string keys to values. Map of string keys to values. Map of string keys to values. ## TykStreamsApiDefinition TykStreamsApiDefinitionSpec defines the desired state of TykStreamsApiDefinition ### tykStreams TykStreams provides storage information about Tyk Streams ConfigmapRef provides information of configmap in which Tyk Streams is stored KeyName is the key of configmap in which Tyk OAS doc is stored Name is the name of configmap Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource. ### contextRef Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## TykMcpProxyDefinition TykMcpProxyDefinitionSpec defines the desired state of TykMcpProxyDefinition ### tykMCP TykMCP provides storage information about MCP proxy configuration ConfigmapRef provides information of configmap in which MCP OAS document is stored KeyName is the key of configmap in which Tyk OAS doc is stored Name is the name of configmap Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource. ### contextRef Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## SecurityPolicy SecurityPolicySpec defines the desired state of SecurityPolicy ### Top-Level Fields Active must be set to `true` for Tyk to load the security policy into memory. Name represents the name of the security policy as displayed in the Dashboard State can be active, draft or deny active: All keys are active and new keys can be created. draft: All keys are active but no new keys can be created. deny: All keys are deactivated and no keys can be created. **Allowed values:** `active`, `draft`, `deny`. MID ("\_id") is generated by Tyk once the resource is created. Do NOT fill this in. If you are linking an existing Policy ID to a new YAML CRD, then fill in this ID field with the "\_id" field. See policies.md readme for more info IsInactive applies to the key itself. Allows enabling or disabling the policy without deleting it. KeyExpiresIn is the number of seconds till key expiry. For 1 hour is 3600. Default never expire or 0 Max depth of a GraphQL query OrgID is overwritten - no point setting this To be used in conjunction with "Rate". Per seconds. 1 minute=60. 1 hour=3600 omit or "-1" for unlimited Value of Quota allowed, omit or "-1" for unlimited Value reset length, in seconds, omit or "-1" for unlimited Rate limit per X seconds (x="Per"), omit or "-1" for unlimited Custom tags to apply to the key, get transfered to the analytics If rate limited, how many seconds to retry a request for. omit or "-1" for unlimited Number of retries before returning error. omit or "-1" for unlimited ### access\_rights Map of string keys to values. AccessDefinition defines which versions of an API a key has access to Name of the ApiDefinition resource to target Namespace of the ApiDefinition resource to target Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key. AccessSpec defines what URLS a user has access to and what methods are enabled APIID is the ID of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually. APIName is the name of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually. DisableIntrospection disables GraphQL introspection if it is set to True. Endpoints is a collection of Endpoint. EndpointMethods is a collection of EndpointMethod. RateLimit holds rate limit configuration. Per is the interval at which rate limit is enforced. Rate is the allowed number of requests per interval. Smoothing contains rate limit smoothing settings. Enabled indicates if rate limit smoothing is active. Delay is the minimum time between rate limit changes (in seconds). Step is the increment/decrement for adjusting the rate limit. Threshold is the request rate above which smoothing is applied. Trigger is the step factor determining when smoothing events trigger. FieldAccessRights is array of depth limit settings per GraphQL APIs. FieldName represents the name of the Query or Mutation which the limit applies to. Limit specifies the numerical value of the limit. MaxQueryDepth represents the numerical value of the limit. TypeName points to a type on which depth limit is set. It can be either Query (most common case) or Mutation JSONRPCMethods defines per-JSON-RPC-method rate limits. RateLimit holds rate limit configuration. Per is the interval at which rate limit is enforced. Rate is the allowed number of requests per interval. Smoothing contains rate limit smoothing settings. Enabled indicates if rate limit smoothing is active. Delay is the minimum time between rate limit changes (in seconds). Step is the increment/decrement for adjusting the rate limit. Threshold is the request rate above which smoothing is applied. Trigger is the step factor determining when smoothing events trigger. Name is the JSON-RPC method name (e.g., "tools/call", "resources/read"). JSONRPCMethodsAccessRights defines allow/block lists for JSON-RPC methods. Kind represents the kind of the linked API Definition resource. It can be either "ApiDefinition" or "TykOasApiDefinition" (case sensitive way). By default, Kind is set to "ApiDefinition". **Allowed values:** `ApiDefinition`, `TykOasApiDefinition`, `TykStreamsApiDefinition`, `TykMcpProxyDefinition`. APILimit stores quota and rate limit on ACL level (per API) Smoothing contains rate limit smoothing settings. Enabled indicates if rate limit smoothing is active. Delay is the minimum time between rate limit changes (in seconds). Step is the increment/decrement for adjusting the rate limit. Threshold is the request rate above which smoothing is applied. Trigger is the step factor determining when smoothing events trigger. MCPAccessRights defines allow/block lists for MCP tools, resources, and prompts. AccessControlRules defines allow/block lists for access control. AccessControlRules defines allow/block lists for access control. AccessControlRules defines allow/block lists for access control. MCPPrimitives defines per-primitive rate limits for MCP tools, resources, and prompts. RateLimit holds rate limit configuration. Per is the interval at which rate limit is enforced. Rate is the allowed number of requests per interval. Smoothing contains rate limit smoothing settings. Enabled indicates if rate limit smoothing is active. Delay is the minimum time between rate limit changes (in seconds). Step is the increment/decrement for adjusting the rate limit. Threshold is the request rate above which smoothing is applied. Trigger is the step factor determining when smoothing events trigger. Name is the primitive name (tool name, resource URI, or prompt name). Type is the MCP primitive type: "tool", "resource", or "prompt". **Allowed values:** `tool`, `resource`, `prompt`. Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key. ### access\_rights\_array AccessDefinition defines which versions of an API a key has access to Name of the ApiDefinition resource to target Namespace of the ApiDefinition resource to target Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key. AccessSpec defines what URLS a user has access to and what methods are enabled APIID is the ID of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually. APIName is the name of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually. DisableIntrospection disables GraphQL introspection if it is set to True. Endpoints is a collection of Endpoint. EndpointMethods is a collection of EndpointMethod. RateLimit holds rate limit configuration. Per is the interval at which rate limit is enforced. Rate is the allowed number of requests per interval. Smoothing contains rate limit smoothing settings. Enabled indicates if rate limit smoothing is active. Delay is the minimum time between rate limit changes (in seconds). Step is the increment/decrement for adjusting the rate limit. Threshold is the request rate above which smoothing is applied. Trigger is the step factor determining when smoothing events trigger. FieldAccessRights is array of depth limit settings per GraphQL APIs. FieldName represents the name of the Query or Mutation which the limit applies to. Limit specifies the numerical value of the limit. MaxQueryDepth represents the numerical value of the limit. TypeName points to a type on which depth limit is set. It can be either Query (most common case) or Mutation JSONRPCMethods defines per-JSON-RPC-method rate limits. RateLimit holds rate limit configuration. Per is the interval at which rate limit is enforced. Rate is the allowed number of requests per interval. Smoothing contains rate limit smoothing settings. Enabled indicates if rate limit smoothing is active. Delay is the minimum time between rate limit changes (in seconds). Step is the increment/decrement for adjusting the rate limit. Threshold is the request rate above which smoothing is applied. Trigger is the step factor determining when smoothing events trigger. Name is the JSON-RPC method name (e.g., "tools/call", "resources/read"). JSONRPCMethodsAccessRights defines allow/block lists for JSON-RPC methods. Kind represents the kind of the linked API Definition resource. It can be either "ApiDefinition" or "TykOasApiDefinition" (case sensitive way). By default, Kind is set to "ApiDefinition". **Allowed values:** `ApiDefinition`, `TykOasApiDefinition`, `TykStreamsApiDefinition`, `TykMcpProxyDefinition`. APILimit stores quota and rate limit on ACL level (per API) Smoothing contains rate limit smoothing settings. Enabled indicates if rate limit smoothing is active. Delay is the minimum time between rate limit changes (in seconds). Step is the increment/decrement for adjusting the rate limit. Threshold is the request rate above which smoothing is applied. Trigger is the step factor determining when smoothing events trigger. MCPAccessRights defines allow/block lists for MCP tools, resources, and prompts. AccessControlRules defines allow/block lists for access control. AccessControlRules defines allow/block lists for access control. AccessControlRules defines allow/block lists for access control. MCPPrimitives defines per-primitive rate limits for MCP tools, resources, and prompts. RateLimit holds rate limit configuration. Per is the interval at which rate limit is enforced. Rate is the allowed number of requests per interval. Smoothing contains rate limit smoothing settings. Enabled indicates if rate limit smoothing is active. Delay is the minimum time between rate limit changes (in seconds). Step is the increment/decrement for adjusting the rate limit. Threshold is the request rate above which smoothing is applied. Trigger is the step factor determining when smoothing events trigger. Name is the primitive name (tool name, resource URI, or prompt name). Type is the MCP primitive type: "tool", "resource", or "prompt". **Allowed values:** `tool`, `resource`, `prompt`. Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key. ### contextRef Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### meta\_data LastUpdated string `json:"last_updated"` ### partitions ## APIDescription APIDescriptionSpec defines the desired state of APIDescription ### Top-Level Fields AuthType displays as a badge next to the name of the API **Allowed values:** `keyless`, `jwt`, `oauth`, `authToken`. Do not set Documentation. Use `docs` instead. IsKeyless toggles visibility of the `Request an API Key button`. Use this when AuthType is keyless, jwt or oauth. LongDescription can be markdown. It allows you to describe the capabilities of the API and is displayed just below the name and AuthType in the catalogue listing page. Name is the title of the API that you wish to be published to the catalogue PolicyID explicitly sets the policy\_id to be published. We do not recommend that this value is set directly. Rather, use `policyRef` instead. ShortDescription is a brief summary of the API shown in the portal catalogue. Note that it may not be rendered by the default portal templates. Show toggles visibility of the API in the portal catalogue Version should always be v2 **Allowed values:** `v2`. ### config Config optionally overrides individual fields of the portal's PortalConfig for this catalogue. CatalogueLoginOnly limits access to catalogues for login users only. DCROptions dynamic client registration options. GrantTypes is an array of OAuth 2.0 grant type strings that the client can use at the token endpoint. **Allowed values:** `client_credentials`, `authorization_code`, `refresh_token`. IDPHost is the fully qualified hostname of the Identity Provider. e.g. [https://mysubdomain.eu.auth0.com](https://mysubdomain.eu.auth0.com) RegistrationEndpoint is the registration\_endpoint as presented in the /.well-known/openid-configuration document. TokenEndpointAuthMethod is an indicator of the requested authentication method for the token endpoint. "none": The client is a public client and does not have a client secret. "client\_secret\_post": The client uses the HTTP POST parameters "client\_secret\_basic": The client uses HTTP Basic authentication **Allowed values:** `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `none`. AccessToken represents an optional bearer token to authenticate with against the registration endpoint Provider is an optional enum of the provider which allows Tyk to register clients outside the standard DCR spec and perform provider specific logic. If your provider is not in this list, please omit. Upon failure, submit a support ticket so that we may extend support for your provider. **Allowed values:** `gluu`, `keycloak`, `okta`. ResponseTypes is an array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. **Allowed values:** `code`, `token`. DisableLogin disables login on developer portal.If you do not want developers to be able to login, set this value to true. You can use this configuration option in the portal templates to display or hide the login form as well as disabling the actual login method. DisableSignup stop developer sign-up to the portal.This will stop developers from being able to signup, they will need to be created manually, or assigned keys via the key management API. EnableDCR activates dynamic client registration. EnableMultiSelection enables subscribing to multiple APIs with single key.User will be able subscript any combination of exposed catalogues of the same authentication type Set by the server. DO NOT set this field it is read only. KeyRequestFields is a slice of fields which are asked of the portal developer when requesting an api key OAuthUsageLimit is the maximum permitted number of OAuth clients OrgID is the organization ID Override overides global settings. These Catalogue settings are currently being overwritten by the Global Catalogue settings. Toggle the checkbox below to override them for this Catalogue. RedirectOnKeyRequest redirects key requests. WHen set to true it will redirect key requests to the url specified in RedirectTo field RedirectTo is a url used to redirect key requests RequireKeyApproval requires reviewing of all key requests before approving them. By default developers will auto-enroll into an API and be given an API key. If you wish to review key requests before giving developers access to the API, enable this option and you will manually need to approve them in the 'Key requests' section of the dashboard. SecureKeyApproval enables Secure key approval.By default, API keys when approved are sent in an email to the Developer. By enabling this option, the Developer will instead receive a link where they can go to generate the API key securely SignUpFields is a slice of fields which are asked of the portal developer when they register for an account ### contextRef k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### docs **Allowed values:** `swagger`, `swagger_custom_url`, `graphql`. ### fields Fields is a generic map of key:value pairs. You may wish to use this to tag a catalogue as type:internal or type:public Then apply logic at the template layer to dynamically display catalogue apis to different user types. ### policyRef k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## OperatorContext OperatorContextSpec defines the desired state of OperatorContext ### env Env is the values of the admin api endpoint that the operator will use to reconcile resources OperatorContextMode is the mode to which the admin api binding is done values are ce for community edition and pro for dashboard **Allowed values:** `ce`, `pro`. ### secretRef Reference to k8s secret resource that we load environment from. k8s resource name The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## PortalAPICatalogue PortalAPICatalogueSpec defines the desired state of PortalAPICatalogue ### Top-Level Fields Email is Catalogue owner email address.Catalogue owner will be notified at this email address when an API subscription request is submitted or granted OrgID is the organization ID ### apis APIDescriptionList is a list of PortalCatalogueDescription published on this PortalAPICatalogue