> ## Documentation Index > Fetch the complete documentation index at: https://tyk.io/docs/llms.txt > Use this file to discover all available pages before exploring further. # Tyk Operator CRD Reference > Field reference for every Tyk Operator Custom Resource Definition (CRD). > [!NOTE] > > This page lists the fields of every Tyk Operator Custom Resource under its `spec`. Field names use dot notation for nested objects (`proxy.target_url`), `[]` for list items (`tags[]`), and `.{key}` for map entries (`auth_configs.{key}`). Within each group, required fields are listed first. Read-only `status` fields are not listed. ## TykOasApiDefinition TykOasApiDefinitionSpec defines the desired state of TykOasApiDefinition ### Top-Level Fields **categories\[]** `string` Categories serve as identifiers for the API definitions, subsequently enabling the filtering of API listings based on these categories. ### tykOAS **tykOAS** `object` *required* TykOAS provides storage information about Tyk OAS **tykOAS.configmapRef** `object` *required* ConfigmapRef provides information of configmap in which Tyk OAS is stored **tykOAS.configmapRef.keyName** `string` *required* KeyName is the key of configmap in which Tyk OAS doc is stored **tykOAS.configmapRef.name** `string` *required* Name is the name of configmap **tykOAS.configmapRef.namespace** `string` Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource. ### certificatePinning **certificatePinning** `object` CertificatePinning contains the configuration related to certificate pinning. It is possible to set Kubernetes secrets containing certificates. It is used to set `upstream.certificatePinning` in Tyk OAS API Definition. **certificatePinning.enabled** `boolean` *required* Enabled is a boolean flag, if set to `true`, it enables certificate pinning for the API. Tyk classic API definition: `certificate_pinning_disabled` **certificatePinning.domainToPublicKeysMapping\[]** `object` DomainToPublicKeysMapping maintains the mapping of domain to pinned public keys. Tyk classic API definition: `pinned_public_keys` **certificatePinning.domainToPublicKeysMapping\[].domain** `string` *required* Domain contains the domain name. **certificatePinning.domainToPublicKeysMapping\[].publicKeyRefs\[]** `string` PublicKeyRefs holds a list of Kubernetes secret names that reside in the same namespace as current TykOasApiDefinition resource. The secret needs to be a type of TLS secret where the pinned public key is stored in `tls.crt` field. Each secret must contain a public key associated with the specified domain name. **NOTE** If you want to continue using secrets that are already created on Tyk Dashboard, specify their IDs in `publicKeys` field of TykOasApiDefinition CR. And then, Tyk Operator will merge this array which is specified through `publicKeys` field with new Tyk Secrets which will be created based on Kubernetes secrets defined in `publicKeyRefs`. **certificatePinning.domainToPublicKeysMapping\[].publicKeys\[]** `string` PublicKeys contains a list of the public keys IDs pinned to the domain name. It only accepts Tyk IDs of the public keys. If you have Kubernetes secrets containing public keys of the domain, please use `publicKeysRefs` field instead of this one. As this one only works with already existing public keys on Tyk Dashboard. ### clientCertificate **clientCertificate** `object` ClientCertificate is used to configure client certificates settings needed for MTLS connection between Tyk and client. It is used to set `server.clientCertificate` field of Tyk OAS API **clientCertificate.allowlist\[]** `string` Allowlist stores list of k8s secret names storing client certificates **clientCertificate.enabled** `boolean` Enabled activates mTLS for the API. ### contextRef **contextRef** `object` Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### customDomain **customDomain** `object` CustomDomain is the domain to bind this API to. This enforces domain matching for client requests. Tyk classic API definition: `domain` **customDomain.enabled** `boolean` *required* Enabled allow/disallow the usage of the domain. **customDomain.name** `string` *required* Name is the name of the domain. **customDomain.certificates\[]** `string` Certificates defines a field for specifying certificate IDs that the Tyk can utilise to dynamically load certificates for your custom domain. Tyk classic API definition: `certificates` **customDomain.certificatesRef\[]** `string` CertificatesRef defines a field for specifying certificates through Kubernetes secrets. Secrets need to be installed within the namespace of the TykOasApiDefinition resource. ### jwtAuth **jwtAuth** `object` JwtAuth holds the configuration for the JWT middleware. **jwtAuth.defaultPoliciesRef\[]** `object` DefaultPolicies is a list of policies specified using their name and namespace. **jwtAuth.defaultPoliciesRef\[].name** `string` *required* k8s resource name **jwtAuth.defaultPoliciesRef\[].namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. **jwtAuth.scopes** `object` Scopes holds the scope to policy mappings for a claim name. **jwtAuth.scopes.claimName** `string` ClaimName contains the claim name. **jwtAuth.scopes.scopeToPolicyMapping\[]** `object` ScopeToPolicyMapping contains the mappings of scopes to policy IDs. **jwtAuth.scopes.scopeToPolicyMapping\[].policyRef** `object` PolicyRef contains the referenced policy based on the name/namespace. **jwtAuth.scopes.scopeToPolicyMapping\[].policyRef.name** `string` *required* k8s resource name **jwtAuth.scopes.scopeToPolicyMapping\[].policyRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. **jwtAuth.scopes.scopeToPolicyMapping\[].scope** `string` Scope contains the scope name. ### mutualTLS **mutualTLS** `object` MutualTLS represents the configuration for an Upstream mTLS. **mutualTLS.enabled** `boolean` *required* Enabled indicates if MTLS should be enabled or not. **mutualTLS.domainToCertificateMapping\[]** `object` DomainToCertificateMapping contains the configuration for an upstream server domain. **mutualTLS.domainToCertificateMapping\[].domain** `string` *required* Domain refers to the domain name of an upstream server. **mutualTLS.domainToCertificateMapping\[].certificateID** `string` Certificate references to Tyk cert ID **mutualTLS.domainToCertificateMapping\[].certificateRef** `string` CertificateRef references the secret containing the domain's SSL Certificate. ### upstreamRequestSigning **upstreamRequestSigning** `object` UpstreamRequestSigning configures HMAC-based request signing for upstream requests. When enabled, it ensures requests are signed before being sent to the upstream service using hmac-sha256 algorithm. **upstreamRequestSigning.algorithm** `string` Algorithm for request signing. For Certificate, it can rsa-sha256. For Secret, it can be any of hmac-sha1, hmac-sha256, hmac-sha384, hmac-sha512. **Allowed values:** `hmac-sha1`, `hmac-sha256`, `hmac-sha384`, `hmac-sha512`, `rsa-sha256`. **upstreamRequestSigning.certificateRef** `string` CertificateRef references the secret containing SSL Certificate. **upstreamRequestSigning.keyId** `string` keyid is mandatory if algorithm is hmac type **upstreamRequestSigning.secretRef** `object` SecretRef references HMAC secret **upstreamRequestSigning.secretRef.keyName** `string` *required* KeyName is the key of secret in which Tyk OAS doc is stored **upstreamRequestSigning.secretRef.name** `string` *required* Name is the name of the secret **upstreamRequestSigning.secretRef.namespace** `string` Namespace is the namespace of secret. If Namespace is not provided, we assume that the secret is in the same namespace as TykOasApiDefinition resource. ### versioning **versioning** `object` Versioning provides versioning information about this OAS API **versioning.enabled** `boolean` *required* Enabled is a boolean flag, if set to true it will enable versioning of the API. **versioning.default** `string` Default contains the default version name if a request is issued without a version. **versioning.fallbackToDefault** `boolean` FallbackToDefault specifies that the default version of the OAS API should be used if the requested version does not exist." **versioning.key** `string` Key contains the name of the key to check for versioning information. **versioning.location** `string` Location contains versioning location information. It can be one of the following: header, url-param, url. **Allowed values:** `header`, `url-param`, `url`. **versioning.name** `string` Name contains the name of the version. **versioning.stripVersioningData** `boolean` StripVersioningData if enabled, specifies that the API responses will be stripped of versioning data. **versioning.urlVersioningPattern** `string` UrlVersioningPattern configure with a regex that matches the versioning identifier format in your URLs. This is essential when using stripVersioningData and fallbackToDefault with location=url." **versioning.versions\[]** `object` Versions contains a list of versions that map to individual API IDs. **versioning.versions\[].name** `string` *required* Name contains the name of the referenced TykOasApiDefinition. **versioning.versions\[].tykOasApiDefinitionRef** `object` *required* TykOasApiDefinitionRef references a TykOasApiDefinition Name and Namespace. **versioning.versions\[].tykOasApiDefinitionRef.name** `string` *required* k8s resource name **versioning.versions\[].tykOasApiDefinitionRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## ApiDefinition APIDefinitionSpec represents the configuration for a single proxied API and it's versions. ### Top-Level Fields **name** `string` *required* **protocol** `string` *required* APIProtocol is the network transport protocol supported by the gateway **Allowed values:** \`\`, `h2c`, `tcp`, `tls`, `http`, `https`. **active** `boolean` Active specifies if the api is enabled or not **allowed\_ips\[]** `string` AllowedIPs is a list of IP address that are whitelisted.When this is provided all IP address that is not on this list will be blocked and a 403 http status will be returned. The IP address can be IPv4 or IPv6.IP in CIDR notation is also supported. **api\_id** `string` Only set this field if you are referring to an existing API def. The Operator will use this APIID to link the CR with the API in Tyk Note: The values in the CR will become the new source of truth, overriding the existing API Definition **base\_identity\_provided\_by** `string` BaseIdentityProvidedBy sets Base Identity Provider for situation when multiple authentication mechanisms are used **Allowed values:** `auth_token`, `hmac_key`, `basic_auth_user`, `jwt_claim`, `oidc_user`, `oauth_key`. **blacklisted\_ips\[]** `string` BlacklistedIPs is a list of IP address that will be blacklisted.This means if origin IP matches any IP in this list a 403 http status code will be returned. The IP address can be IPv4 or IPv6. IP in CIDR notation is also supported. **certificate\_secret\_names\[]** `string` CertificateSecretNames represents the names of the secrets that the controller should look for in the current namespace which contain the certificates. **certificates\[]** `string` Certificates is a list of Tyk Certificate IDs. e.g. orgid+fingerprint. Use CertificateSecretNames if using cert-manager **client\_certificate\_refs\[]** `string` **client\_certificates\[]** `string` **config\_data** `object` ConfigData can be used to pass custom attributes (a JSON object) into your middleware, such as a virtual endpoint or header transform. Free-form object with arbitrary keys. **custom\_middleware\_bundle** `string` **detailed\_tracing** `boolean` **disable\_quota** `boolean` DisableQuota allows you to disable quota middleware in a given API Definition. **disable\_rate\_limit** `boolean` DisableRateLimit allows you to disable rate limits in a given API Definition. **do\_not\_track** `boolean` DoNotTrack disables endpoint tracking for this API **domain** `string` Domain represents a custom host header that the gateway will listen on for this API **enable\_context\_vars** `boolean` EnableContextVars extracts request context variables from the start of the middleware chain. Set this to true to make them available to your transforms. Context Variables are available in the url rewriter, modify headers and body transforms. **enable\_coprocess\_auth** `boolean` **enable\_detailed\_recording** `boolean` EnableDetailedRecording instructs Tyk store the inbound request and outbound response data in HTTP Wire format as part of the Analytics data **enable\_ip\_blacklisting** `boolean` EnableIPBlacklisting activates the ip blacklisting middleware. **enable\_ip\_whitelisting** `boolean` EnableIPWhiteListing activates the ip whitelisting middleware. **enable\_jwt** `boolean` EnableJWT set JWT as the access method for this API. **enable\_proxy\_protocol** `boolean` **id** `string` For server use only, do not use **internal** `boolean` Internal tells Tyk Gateway that this is a virtual API. It can only be routed to from other APIs. **jwt\_client\_base\_field** `string` JWTClientIDBaseField is the name of the field on JWT claim to use for client id. This field is mutually exclusive to jwt\_identity\_base\_field, meaning you can only set/use one and jwt\_identity\_base\_field takes precedence when both are set. **jwt\_default\_policies\[]** `string` JWTDefaultPolicies is a list of policies that will be used when base policy can't be extracted from the JWT token. When this list is provided the first element will be used as the base policy while the rest of elements will be applied. **jwt\_expires\_at\_validation\_skew** `integer` JWTExpiresAtValidationSkew adds validation for expired at JWT claim. Given now = current unix time skew = jwt\_expires\_at\_validation\_skew exp = expired at If exp > (now - skew) then validation will fail with "token has expired" **jwt\_identity\_base\_field** `string` JWTIdentityBaseField Identifies the user or identity to be used in the Claims of the JWT. This will fallback to sub if not found. This field forms the basis of a new “virtual” token that gets used after validation. It means policy attributes are carried forward through Tyk for attribution purposes. **jwt\_issued\_at\_validation\_skew** `integer` JWTIssuedAtValidationSkew adds validation for issued at JWT claim. Given now = current unix time skew = jwt\_issued\_at\_validation\_skew iat = the issued at jwt claim If iat > (now + skew) then validation will fail with "token used before issued" **jwt\_not\_before\_validation\_skew** `integer` JWTNotBeforeValidationSkew adds validation for not before JWT claim. Given now = current unix time skew = jwt\_not\_before\_validation\_skew nbf = the not before jwt claim If nbf > (now + skew) then validation will fail with "token is not valid yet" **jwt\_policy\_field\_name** `string` JWTPolicyFieldName The policy ID to apply to the virtual token generated for a JWT **jwt\_scope\_claim\_name** `string` JWTScopeClaimName overides the key used for scope values in the JWT claims. By default the value is "scope" **jwt\_signing\_method** `string` JWTSigningMethod algorithm used to sign jwt token **Allowed values:** \`\`, `rsa`, `hmac`, `ecdsa`. **jwt\_skip\_kid** `boolean` JWTSkipKid when true we ingore using kid as the identity for a JWT token and instead use jwt\_identity\_base\_field if it was set or fallback to sub JWT claim. **jwt\_source** `string` JWTSource Must either be a base64 encoded valid RSA/HMAC key or a url to a resource serving JWK, this key will then be used to validate inbound JWT and throttle them according to the centralised JWT options and fields set in the configuration. **listen\_port** `integer` **org\_id** `string` OrgID is overwritten - no point setting this **session\_lifetime** `integer` SessionLifetime this is duration in seconds before the session key expires in redis. Example: If you want the session keys to be alive only 24 hours you can set this value to 86400 that we can break down to 60 \* 60 \* 24 = Total seconds in a day **strip\_auth\_data** `boolean` StripAuthData ensures that any security tokens used for accessing APIs are stripped and not leaked to the upstream **tag\_headers\[]** `string` **tags\[]** `string` Tags are named gateway nodes which tell gateway clusters whether to load an API or not. for example, to load the API in an ARA gateway, you might want to include an `edge` tag. **use\_basic\_auth** `boolean` UseBasicAuth enables basic authentication **use\_go\_plugin\_auth** `boolean` Enable Go Plugin Auth. Needs to be combined with "use\_keyless:false" **use\_keyless** `boolean` UseKeylessAccess will switch off all key checking. Some analytics will still be recorded, but rate-limiting, quotas and security policies will not be possible (there is no session to attach requests to). **use\_mutual\_tls\_auth** `boolean` UseMutualTLSAuth enables mututal TLS authentication **use\_oauth2** `boolean` UseOAuth2 enables oauth2 authorization **use\_standard\_auth** `boolean` UseStandardAuth enables simple bearer token authentication ### proxy **proxy** `object` *required* Proxy **proxy.target\_url** `string` *required* TargetURL defines the target URL that the request should be proxied to. **proxy.check\_host\_against\_uptime\_tests** `boolean` CheckHostAgainstUptimeTests will check the hostname of the outbound request against the downtime list generated by the uptime test host checker. If the host is found, then it is skipped or removed from the load balancer. This is only valid if uptime tests for the api are enabled. **proxy.disable\_strip\_slash** `boolean` DisableStripSlash disables the stripping of the slash suffix from a URL. when `true` a request to [http://foo.bar/baz/](http://foo.bar/baz/) will be retained. when `false` a request to [http://foo.bar/baz/](http://foo.bar/baz/) will be matched to [http://foo.bar/baz](http://foo.bar/baz) **proxy.enable\_load\_balancing** `boolean` EnableLoadBalancing enables Tyk's round-robin loadbalancer. Tyk will ignore the TargetURL field, and rely on the hosts in the Targets list **proxy.listen\_path** `string` ListenPath represents the path to listen on. e.g. `/api` or `/` or `/httpbin`. Any requests coming into the host, on the port that Tyk is configured to run on, that match this path will have the rules defined in the API Definition applied. Versioning assumes that different versions of an API will live on the same URL structure. If you are using URL-based versioning (e.g. /v1/function, /v2/function) then it is recommended to set up a separate non-versioned definition for each version as they are essentially separate APIs. **proxy.preserve\_host\_header** `boolean` If PreserveHostHeader is set to true then the host header in the outbound request is retained to be the inbound hostname of the proxy. **proxy.service\_discovery** `object` ServiceDiscovery configures integration with an external service discovery system (for example Consul, etcd or Eureka) that the gateway queries to resolve the upstream target hosts at runtime. **proxy.service\_discovery.cache\_timeout** `integer` *required* **proxy.service\_discovery.data\_path** `string` *required* **proxy.service\_discovery.endpoint\_returns\_list** `boolean` *required* **proxy.service\_discovery.parent\_data\_path** `string` *required* **proxy.service\_discovery.port\_data\_path** `string` *required* **proxy.service\_discovery.query\_endpoint** `string` *required* **proxy.service\_discovery.target\_path** `string` *required* **proxy.service\_discovery.use\_discovery\_service** `boolean` *required* **proxy.service\_discovery.use\_nested\_query** `boolean` *required* **proxy.service\_discovery.use\_target\_list** `boolean` *required* **proxy.strip\_listen\_path** `boolean` StripListenPath removes the inbound listen path in the outgoing request. e.g. [http://acme.com/httpbin/get](http://acme.com/httpbin/get) where `httpbin` is the listen path. The `httpbin` listen path which is used to identify the API loaded in Tyk is removed, and the outbound request would be [http://httpbin.org/get](http://httpbin.org/get) **proxy.target\_internal** `object` **proxy.target\_internal.path** `string` Path path on target , this does not include query parameters. example /myendpoint **proxy.target\_internal.query** `string` Query url query string to add to target example check\_limits=true **proxy.target\_internal.target** `object` API a namespaced/name to the api definition resource that you are targetting **proxy.target\_internal.target.name** `string` *required* k8s resource name **proxy.target\_internal.target.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. **proxy.target\_list\[]** `string` Targets defines a list of upstream host targets. Tyk will then round-robin load balance between these targets. EnableLoadBalancing must be set to true in order to take advantage of this feature. **proxy.transport** `object` Transport section exposes advanced transport level configurations such as minimum TLS version. **proxy.transport.proxy\_url** `string` ProxyURL specifies custom forward proxy & port. e.g. `http(s)://proxy.url:1234` **proxy.transport.ssl\_ciphers\[]** `string` SSLCipherSuites is an array of acceptable cipher suites. A list of allowed cipher suites can be found in the Go Crypto TLS package constants documentation [https://golang.org/pkg/crypto/tls/#pkg-constants](https://golang.org/pkg/crypto/tls/#pkg-constants) **proxy.transport.ssl\_force\_common\_name\_check** `boolean` SSLForceCommonNameCheck forces hostname validation against the certificate Common Name **proxy.transport.ssl\_insecure\_skip\_verify** `boolean` SSLInsecureSkipVerify controls whether it is possible to use self-signed certificates when connecting to the upstream. This is applied to `TykMakeHttpRequest` & `TykMakeBatchRequest` in virtual endpoint middleware. **proxy.transport.ssl\_min\_version** `integer` SSLMinVersion defines the minimum TLS version the gateway will use to establish a connection to the upstream. 1.0: 769; 1.1: 770; 1.2: 771; 1.3: 772. **Allowed values:** `769`, `770`, `771`, `772`. ### analytics\_plugin **analytics\_plugin** `object` AnalyticsPlugin is used to configure analytics plugin which enables editing or removal of all parts of analytics records, raw `request` and responses recorded by Tyk at the gateway level **analytics\_plugin.enable** `boolean` *required* **analytics\_plugin.func\_name** `string` **analytics\_plugin.plugin\_path** `string` ### auth **auth** `object` **auth.auth\_header\_name** `string` *required* **auth.cookie\_name** `string` **auth.param\_name** `string` **auth.signature** `object` **auth.signature.algorithm** `string` *required* **auth.signature.allowed\_clock\_skew** `integer` *required* **auth.signature.error\_code** `integer` *required* **auth.signature.error\_message** `string` *required* **auth.signature.header** `string` *required* **auth.signature.secret** `string` *required* **auth.use\_certificate** `boolean` **auth.use\_cookie** `boolean` **auth.use\_param** `boolean` **auth.validate\_signature** `boolean` ### auth\_configs **auth\_configs** `object` Map of string keys to values. **auth\_configs.\{key}** `object` **auth\_configs.\{key}.auth\_header\_name** `string` *required* **auth\_configs.\{key}.cookie\_name** `string` **auth\_configs.\{key}.param\_name** `string` **auth\_configs.\{key}.signature** `object` **auth\_configs.\{key}.signature.algorithm** `string` *required* **auth\_configs.\{key}.signature.allowed\_clock\_skew** `integer` *required* **auth\_configs.\{key}.signature.error\_code** `integer` *required* **auth\_configs.\{key}.signature.error\_message** `string` *required* **auth\_configs.\{key}.signature.header** `string` *required* **auth\_configs.\{key}.signature.secret** `string` *required* **auth\_configs.\{key}.use\_certificate** `boolean` **auth\_configs.\{key}.use\_cookie** `boolean` **auth\_configs.\{key}.use\_param** `boolean` **auth\_configs.\{key}.validate\_signature** `boolean` ### cache\_options **cache\_options** `object` **cache\_options.cache\_timeout** `integer` *required* CacheTimeout is the TTL for a cached object in seconds **cache\_options.cache\_all\_safe\_requests** `boolean` CacheAllSafeRequests caches responses to (GET, HEAD, OPTIONS) requests overrides per-path cache settings in versions, applies across versions **cache\_options.cache\_by\_headers\[]** `string` CacheByHeaders allows header values to be used as part of the cache key **cache\_options.cache\_control\_ttl\_header** `string` CacheControlTTLHeader is the response header which tells Tyk how long it is safe to cache the response for **cache\_options.cache\_response\_codes\[]** `integer` CacheOnlyResponseCodes is an array of response codes which are safe to cache. e.g. 404 **cache\_options.enable\_cache** `boolean` EnableCache turns global cache middleware on or off. It is still possible to enable caching on a per-path basis by explicitly setting the endpoint cache middleware. see `spec.version_data.versions.{VERSION}.extended_paths.cache[]` **cache\_options.enable\_upstream\_cache\_control** `boolean` EnableUpstreamCacheControl instructs Tyk Cache to respect upstream cache control headers ### contextRef **contextRef** `object` Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### CORS **CORS** `object` **CORS.allow\_credentials** `boolean` AllowCredentials if true will allow cookies **CORS.allowed\_headers\[]** `string` AllowedHeaders are headers that are allowed within a request. **CORS.allowed\_methods\[]** `string` AllowedMethods is a list of methods to allow access via. **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **CORS.allowed\_origins\[]** `string` AllowedOrigins is a list of origin domains to allow access from. **CORS.debug** `boolean` Debug if true, this option produces log files for the CORS middleware **CORS.enable** `boolean` Enable when set to true it enables the cors middleware for the api **CORS.exposed\_headers\[]** `string` ExposedHeaders is a list of headers that are exposed back in the response. **CORS.max\_age** `integer` MaxAge is the maximum age of credentials **CORS.options\_passthrough** `boolean` OptionsPassthrough allow CORS OPTIONS preflight request to be proxied directly to upstream, without authentication and rest of checks. This means that pre-flight requests generated by web-clients such as SwaggerUI or the Tyk Portal documentation system will be able to test the API using trial keys. If your service handles CORS natively, then enable this option. ### custom\_middleware **custom\_middleware** `object` **custom\_middleware.driver** `string` *required* **custom\_middleware.auth\_check** `object` **custom\_middleware.auth\_check.name** `string` *required* **custom\_middleware.auth\_check.path** `string` *required* **custom\_middleware.auth\_check.raw\_body\_only** `boolean` **custom\_middleware.auth\_check.require\_session** `boolean` **custom\_middleware.id\_extractor** `object` **custom\_middleware.id\_extractor.extract\_from** `string` *required* **custom\_middleware.id\_extractor.extract\_with** `string` *required* **custom\_middleware.id\_extractor.extractor\_config** `object` *required* **custom\_middleware.id\_extractor.extractor\_config.header\_name** `string` **custom\_middleware.id\_extractor.extractor\_config.param\_name** `string` **custom\_middleware.id\_extractor.extractor\_config.regex\_expression** `string` **custom\_middleware.id\_extractor.extractor\_config.regex\_match\_index** `integer` **custom\_middleware.post\[]** `object` **custom\_middleware.post\[].name** `string` *required* **custom\_middleware.post\[].path** `string` *required* **custom\_middleware.post\[].raw\_body\_only** `boolean` **custom\_middleware.post\[].require\_session** `boolean` **custom\_middleware.post\_key\_auth\[]** `object` **custom\_middleware.post\_key\_auth\[].name** `string` *required* **custom\_middleware.post\_key\_auth\[].path** `string` *required* **custom\_middleware.post\_key\_auth\[].raw\_body\_only** `boolean` **custom\_middleware.post\_key\_auth\[].require\_session** `boolean` **custom\_middleware.pre\[]** `object` **custom\_middleware.pre\[].name** `string` *required* **custom\_middleware.pre\[].path** `string` *required* **custom\_middleware.pre\[].raw\_body\_only** `boolean` **custom\_middleware.pre\[].require\_session** `boolean` **custom\_middleware.response\[]** `object` **custom\_middleware.response\[].name** `string` *required* **custom\_middleware.response\[].path** `string` *required* **custom\_middleware.response\[].raw\_body\_only** `boolean` **custom\_middleware.response\[].require\_session** `boolean` ### definition **definition** `object` VersionDefinition is a struct that holds the version information for the API **definition.key** `string` *required* **definition.location** `string` *required* **definition.default** `string` **definition.enabled** `boolean` **definition.fallback\_to\_default** `boolean` **definition.name** `string` **definition.strip\_path** `boolean` Deprecated: use StripVersioningData instead. **definition.strip\_versioning\_data** `boolean` **definition.url\_versioning\_pattern** `string` **definition.versions** `object` Map of string keys to values. **definition.versions.\{key}** `string` ### event\_handlers **event\_handlers** `object` **event\_handlers.events** `object` *required* Map of string keys to values. **event\_handlers.events.\{key}\[]** `object` **event\_handlers.events.\{key}\[].handler\_meta** `object` *required* MapStringInterfaceType represents a generic struct used as a map\[string]interface\{}. Since an arbitrary JSON fields defined as map\[string]interface\{} is not feasible to use as a Kubernetes CRD, unstructured.Unstructured type is used. Free-form object with arbitrary keys. **event\_handlers.events.\{key}\[].handler\_name** `string` *required* ### global\_rate\_limit **global\_rate\_limit** `object` GlobalRateLimit is an API Level Global Rate Limit, which assesses all traffic coming into the API from all sources and ensures that the overall rate limit is not exceeded. **global\_rate\_limit.per** `integer` *required* Per represents a time window in seconds **global\_rate\_limit.rate** `integer` *required* Rate represents the number of requests allowed within a specified time window (Per) ### graphql **graphql** `object` GraphQLConfig is the root config object for a GraphQL API. **graphql.enabled** `boolean` *required* Enabled indicates if GraphQL proxy should be enabled. **graphql.execution\_mode** `string` *required* GraphQLExecutionMode is the mode to define how an api behaves. **Allowed values:** \`\`, `proxyOnly`, `executionEngine`, `supergraph`, `subgraph`. **graphql.engine** `object` Engine holds the configuration for engine v2 and upwards. **graphql.engine.data\_sources\[]** `object` *required* **graphql.engine.data\_sources\[].config** `object` *required* MapStringInterfaceType represents a generic struct used as a map\[string]interface\{}. Since an arbitrary JSON fields defined as map\[string]interface\{} is not feasible to use as a Kubernetes CRD, unstructured.Unstructured type is used. Free-form object with arbitrary keys. **graphql.engine.data\_sources\[].internal** `boolean` *required* **graphql.engine.data\_sources\[].kind** `string` *required* **Allowed values:** `REST`, `GraphQL`, `Kafka`. **graphql.engine.data\_sources\[].name** `string` *required* **graphql.engine.data\_sources\[].root\_fields\[]** `object` *required* **graphql.engine.data\_sources\[].root\_fields\[].fields\[]** `string` *required* **graphql.engine.data\_sources\[].root\_fields\[].type** `string` *required* **graphql.engine.field\_configs\[]** `object` *required* **graphql.engine.field\_configs\[].disable\_default\_mapping** `boolean` *required* **graphql.engine.field\_configs\[].field\_name** `string` *required* **graphql.engine.field\_configs\[].path\[]** `string` *required* **graphql.engine.field\_configs\[].type\_name** `string` *required* **graphql.engine.global\_headers\[]** `object` GlobalHeaders for managing headers for UDG and all associated data sources **graphql.engine.global\_headers\[].key** `string` *required* Key is the name of the request header **graphql.engine.global\_headers\[].value** `string` *required* Value holds the value of the request header **graphql.graph\_ref** `string` **graphql.introspection** `object` Introspection holds the configuration for GraphQL Introspection **graphql.introspection.disabled** `boolean` **graphql.last\_schema\_update** `string` LastSchemaUpdate contains the date and time of the last triggered schema update to the upstream. **graphql.playground** `object` GraphQLPlayground is the Playground specific configuration. **graphql.playground.enabled** `boolean` *required* Enabled indicates if the playground should be enabled. **graphql.playground.path** `string` *required* Path sets the path on which the playground will be hosted if enabled. **graphql.proxy** `object` Proxy holds the configuration for a proxy only api. **graphql.proxy.auth\_headers** `object` Map of string keys to values. **graphql.proxy.auth\_headers.\{key}** `string` **graphql.proxy.features** `object` **graphql.proxy.features.use\_immutable\_headers** `boolean` **graphql.proxy.request\_headers** `object` Map of string keys to values. **graphql.proxy.request\_headers.\{key}** `string` **graphql.proxy.request\_headers\_rewrite** `object` Map of string keys to values. **graphql.proxy.request\_headers\_rewrite.\{key}** `object` **graphql.proxy.request\_headers\_rewrite.\{key}.remove** `boolean` *required* **graphql.proxy.request\_headers\_rewrite.\{key}.value** `string` *required* **graphql.proxy.subscription\_type** `string` SubscriptionType is the subscription protocol to use for graphql subscriptions **Allowed values:** \`\`, `graphql-ws`, `graphql-transport-ws`, `sse`. **graphql.proxy.use\_response\_extensions** `object` **graphql.proxy.use\_response\_extensions.on\_error\_forwarding** `boolean` *required* **graphql.schema** `string` Schema is the GraphQL Schema exposed by the GraphQL API/Upstream/Engine. **graphql.subgraph** `object` Subgraph holds the configuration for a GraphQL federation subgraph. **graphql.subgraph.sdl** `string` *required* **graphql.supergraph** `object` Supergraph holds the configuration for a GraphQL federation supergraph. **graphql.supergraph.disable\_query\_batching** `boolean` **graphql.supergraph.global\_headers** `object` Map of string keys to values. **graphql.supergraph.global\_headers.\{key}** `string` **graphql.supergraph.merged\_sdl** `string` **graphql.supergraph.subgraphs\[]** `object` **graphql.supergraph.subgraphs\[].api\_id** `string` *required* UUID v4 string (!not the same as \_id of APIDefinition) **graphql.supergraph.subgraphs\[].headers** `object` *required* Map of string keys to values. **graphql.supergraph.subgraphs\[].headers.\{key}** `string` **graphql.supergraph.subgraphs\[].name** `string` *required* **graphql.supergraph.subgraphs\[].sdl** `string` *required* the schema definition language of the subgraph **graphql.supergraph.subgraphs\[].url** `string` *required* The internal URL of the subgraph **graphql.supergraph.updated\_at** `string` UpdatedAt contains the date and time of the last update of a supergraph API. **graphql.type\_field\_configurations\[]** `object` TypeFieldConfigurations is a rule set of data source and mapping of a schema field. **graphql.type\_field\_configurations\[].data\_source** `object` *required* **graphql.type\_field\_configurations\[].data\_source.kind** `string` *required* Kind defines the unique identifier of the DataSource Kind needs to match to the Planner "DataSourceName" name **Allowed values:** `GraphQLDataSource`, `HTTPJSONDataSource`. **graphql.type\_field\_configurations\[].data\_source.data\_source\_config** `object` Config is the DataSource specific configuration object Each Planner needs to make sure to parse their Config Object correctly **graphql.type\_field\_configurations\[].data\_source.data\_source\_config.method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **graphql.type\_field\_configurations\[].data\_source.data\_source\_config.url** `string` *required* **graphql.type\_field\_configurations\[].data\_source.data\_source\_config.body** `string` **graphql.type\_field\_configurations\[].data\_source.data\_source\_config.default\_type\_name** `string` **graphql.type\_field\_configurations\[].data\_source.data\_source\_config.headers\[]** `string` **graphql.type\_field\_configurations\[].data\_source.data\_source\_config.status\_code\_type\_name\_mappings\[]** `object` **graphql.type\_field\_configurations\[].data\_source.data\_source\_config.status\_code\_type\_name\_mappings\[].status\_code** `integer` *required* **graphql.type\_field\_configurations\[].data\_source.data\_source\_config.status\_code\_type\_name\_mappings\[].type\_name** `string` **graphql.type\_field\_configurations\[].field\_name** `string` *required* **graphql.type\_field\_configurations\[].mapping** `object` *required* **graphql.type\_field\_configurations\[].mapping.disabled** `boolean` *required* **graphql.type\_field\_configurations\[].mapping.path** `string` *required* **graphql.type\_field\_configurations\[].type\_name** `string` *required* **graphql.version** `string` Version defines the version of the GraphQL config and engine to be used. **Allowed values:** `1`, `2`. ### jwt\_scope\_to\_policy\_mapping **jwt\_scope\_to\_policy\_mapping** `object` JWTScopeToPolicyMapping this is a mapping of scope value to policy id. If this is set then a scope value found in this map will make the mappend policy to be applied. **jwt\_scope\_to\_policy\_mapping.\{key}** `string` ### oauth\_meta **oauth\_meta** `object` **oauth\_meta.allowed\_access\_types\[]** `string` *required* AllowedAccessTypes are an array of allowable access types. **Allowed values:** `authorization_code`, `refresh_token`, `password`, `client_credentials`. **oauth\_meta.allowed\_authorize\_types\[]** `string` *required* AllowedAuthorizeTypes is an array of allowable `response_type` parameters `token` or authorization code `code`. Choose token for client\_credentials or implicit grant types. **Allowed values:** `code`, `token`. **oauth\_meta.auth\_login\_redirect** `string` Login form to handle user login. ### pinned\_public\_keys **pinned\_public\_keys** `object` PinnedPublicKeys allows you to whitelist public keys used to generate certificates, so you will be protected in case an upstream certificate is compromised. Please use PinnedPublicKeysRefs if using cert-manager. **pinned\_public\_keys.\{key}** `string` ### pinned\_public\_keys\_refs **pinned\_public\_keys\_refs** `object` PinnedPublicKeysRefs allows you to specify public keys using k8s secret. It takes domain name as a key and secret name as a value. **pinned\_public\_keys\_refs.\{key}** `string` ### response\_processors **response\_processors\[]** `object` **response\_processors\[].name** `string` *required* ### upstream\_certificate\_refs **upstream\_certificate\_refs** `object` UpstreamCertificateRefs is a map of domains and secret names that is used internally to obtain certificates from secrets in order to establish mTLS support for upstreams **upstream\_certificate\_refs.\{key}** `string` ### upstream\_certificates **upstream\_certificates** `object` UpstreamCertificates is a map of domains and certificate IDs that is used by the Tyk Gateway to provide mTLS support for upstreams **upstream\_certificates.\{key}** `string` ### uptime\_tests **uptime\_tests** `object` UptimeTests is a struct that holds the uptime test information for the API **uptime\_tests.check\_list\[]** `object` **uptime\_tests.check\_list\[].url** `string` *required* **uptime\_tests.check\_list\[].body** `string` **uptime\_tests.check\_list\[].commands\[]** `object` **uptime\_tests.check\_list\[].commands\[].message** `string` *required* **uptime\_tests.check\_list\[].commands\[].name** `string` *required* **uptime\_tests.check\_list\[].enable\_proxy\_protocol** `boolean` **uptime\_tests.check\_list\[].headers** `object` Map of string keys to values. **uptime\_tests.check\_list\[].headers.\{key}** `string` **uptime\_tests.check\_list\[].method** `string` HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **uptime\_tests.check\_list\[].protocol** `string` **uptime\_tests.check\_list\[].timeout** `integer` A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years. **uptime\_tests.config** `object` **uptime\_tests.config.expire\_utime\_after** `integer` must have an expireAt TTL index set ([http://docs.mongodb.org/manual/tutorial/expire-data/](http://docs.mongodb.org/manual/tutorial/expire-data/)) **uptime\_tests.config.recheck\_wait** `integer` **uptime\_tests.config.service\_discovery** `object` **uptime\_tests.config.service\_discovery.cache\_timeout** `integer` *required* **uptime\_tests.config.service\_discovery.data\_path** `string` *required* **uptime\_tests.config.service\_discovery.endpoint\_returns\_list** `boolean` *required* **uptime\_tests.config.service\_discovery.parent\_data\_path** `string` *required* **uptime\_tests.config.service\_discovery.port\_data\_path** `string` *required* **uptime\_tests.config.service\_discovery.query\_endpoint** `string` *required* **uptime\_tests.config.service\_discovery.target\_path** `string` *required* **uptime\_tests.config.service\_discovery.use\_discovery\_service** `boolean` *required* **uptime\_tests.config.service\_discovery.use\_nested\_query** `boolean` *required* **uptime\_tests.config.service\_discovery.use\_target\_list** `boolean` *required* ### version\_data **version\_data** `object` **version\_data.default\_version** `string` *required* **version\_data.not\_versioned** `boolean` *required* **version\_data.versions** `object` Map of string keys to values. **version\_data.versions.\{key}** `object` **version\_data.versions.\{key}.name** `string` *required* **version\_data.versions.\{key}.expires** `string` **version\_data.versions.\{key}.extended\_paths** `object` **version\_data.versions.\{key}.extended\_paths.advance\_cache\_config\[]** `object` **version\_data.versions.\{key}.extended\_paths.advance\_cache\_config\[].cache\_key\_regex** `string` *required* **version\_data.versions.\{key}.extended\_paths.advance\_cache\_config\[].cache\_response\_codes\[]** `integer` *required* **version\_data.versions.\{key}.extended\_paths.advance\_cache\_config\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.advance\_cache\_config\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.advance\_cache\_config\[].timeout** `integer` **version\_data.versions.\{key}.extended\_paths.black\_list\[]** `object` **version\_data.versions.\{key}.extended\_paths.black\_list\[].ignore\_case** `boolean` *required* **version\_data.versions.\{key}.extended\_paths.black\_list\[].method\_actions** `object` *required* Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.black\_list\[].method\_actions.\{key}** `object` **version\_data.versions.\{key}.extended\_paths.black\_list\[].method\_actions.\{key}.action** `string` *required* **version\_data.versions.\{key}.extended\_paths.black\_list\[].method\_actions.\{key}.code** `integer` *required* **version\_data.versions.\{key}.extended\_paths.black\_list\[].method\_actions.\{key}.data** `string` *required* **version\_data.versions.\{key}.extended\_paths.black\_list\[].method\_actions.\{key}.headers** `object` *required* Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.black\_list\[].method\_actions.\{key}.headers.\{key}** `string` **version\_data.versions.\{key}.extended\_paths.black\_list\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.cache\[]** `string` List of paths which cache middleware should be enabled on **version\_data.versions.\{key}.extended\_paths.circuit\_breakers\[]** `object` **version\_data.versions.\{key}.extended\_paths.circuit\_breakers\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.circuit\_breakers\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.circuit\_breakers\[].return\_to\_service\_after** `integer` *required* ReturnToServiceAfter represents the time in seconds to return back to the service **version\_data.versions.\{key}.extended\_paths.circuit\_breakers\[].samples** `integer` *required* Samples defines the number of requests to base the ThresholdPercent on **version\_data.versions.\{key}.extended\_paths.circuit\_breakers\[].threshold\_percent** `string` *required* ThresholdPercent is the percentage of requests that fail before breaker is tripped **version\_data.versions.\{key}.extended\_paths.circuit\_breakers\[].disable\_half\_open\_state** `boolean` **version\_data.versions.\{key}.extended\_paths.do\_not\_track\_endpoints\[]** `object` **version\_data.versions.\{key}.extended\_paths.do\_not\_track\_endpoints\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.do\_not\_track\_endpoints\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.hard\_timeouts\[]** `object` **version\_data.versions.\{key}.extended\_paths.hard\_timeouts\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.hard\_timeouts\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.hard\_timeouts\[].timeout** `integer` *required* **version\_data.versions.\{key}.extended\_paths.ignored\[]** `object` **version\_data.versions.\{key}.extended\_paths.ignored\[].ignore\_case** `boolean` *required* **version\_data.versions.\{key}.extended\_paths.ignored\[].method\_actions** `object` *required* Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.ignored\[].method\_actions.\{key}** `object` **version\_data.versions.\{key}.extended\_paths.ignored\[].method\_actions.\{key}.action** `string` *required* **version\_data.versions.\{key}.extended\_paths.ignored\[].method\_actions.\{key}.code** `integer` *required* **version\_data.versions.\{key}.extended\_paths.ignored\[].method\_actions.\{key}.data** `string` *required* **version\_data.versions.\{key}.extended\_paths.ignored\[].method\_actions.\{key}.headers** `object` *required* Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.ignored\[].method\_actions.\{key}.headers.\{key}** `string` **version\_data.versions.\{key}.extended\_paths.ignored\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.internal\[]** `object` **version\_data.versions.\{key}.extended\_paths.internal\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.internal\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.method\_transforms\[]** `object` **version\_data.versions.\{key}.extended\_paths.method\_transforms\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.method\_transforms\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.method\_transforms\[].to\_method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.size\_limits\[]** `object` **version\_data.versions.\{key}.extended\_paths.size\_limits\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.size\_limits\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.size\_limits\[].size\_limit** `integer` *required* **version\_data.versions.\{key}.extended\_paths.track\_endpoints\[]** `object` **version\_data.versions.\{key}.extended\_paths.track\_endpoints\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.track\_endpoints\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\[]** `object` **version\_data.versions.\{key}.extended\_paths.transform\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.transform\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\[].template\_data** `object` *required* **version\_data.versions.\{key}.extended\_paths.transform\[].template\_data.enable\_session** `boolean` *required* **version\_data.versions.\{key}.extended\_paths.transform\[].template\_data.input\_type** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\[].template\_data.template\_mode** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\[].template\_data.template\_source** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_headers\[]** `object` **version\_data.versions.\{key}.extended\_paths.transform\_headers\[].act\_on** `boolean` *required* **version\_data.versions.\{key}.extended\_paths.transform\_headers\[].add\_headers** `object` *required* Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.transform\_headers\[].add\_headers.\{key}** `string` **version\_data.versions.\{key}.extended\_paths.transform\_headers\[].delete\_headers\[]** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_headers\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.transform\_headers\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_jq\[]** `object` **version\_data.versions.\{key}.extended\_paths.transform\_jq\[].filter** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_jq\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.transform\_jq\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_jq\_response\[]** `object` **version\_data.versions.\{key}.extended\_paths.transform\_jq\_response\[].filter** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_jq\_response\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.transform\_jq\_response\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_response\[]** `object` **version\_data.versions.\{key}.extended\_paths.transform\_response\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.transform\_response\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_response\[].template\_data** `object` *required* **version\_data.versions.\{key}.extended\_paths.transform\_response\[].template\_data.enable\_session** `boolean` *required* **version\_data.versions.\{key}.extended\_paths.transform\_response\[].template\_data.input\_type** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_response\[].template\_data.template\_mode** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_response\[].template\_data.template\_source** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_response\_headers\[]** `object` **version\_data.versions.\{key}.extended\_paths.transform\_response\_headers\[].act\_on** `boolean` *required* **version\_data.versions.\{key}.extended\_paths.transform\_response\_headers\[].add\_headers** `object` *required* Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.transform\_response\_headers\[].add\_headers.\{key}** `string` **version\_data.versions.\{key}.extended\_paths.transform\_response\_headers\[].delete\_headers\[]** `string` *required* **version\_data.versions.\{key}.extended\_paths.transform\_response\_headers\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.transform\_response\_headers\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[]** `object` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].match\_pattern** `string` *required* MatchPattern is a regular expression pattern to match the path **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].path** `string` *required* Path represents the endpoint listen path **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].rewrite\_to** `string` RewriteTo is the target path on the upstream, or target URL we wish to rewrite to **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].rewrite\_to\_internal** `object` RewriteToInternal serves as rewrite\_to but used when rewriting to target internal api's When rewrite\_to and rewrite\_to\_internal are both provided then rewrite\_to will take rewrite\_to\_internal **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].rewrite\_to\_internal.path** `string` Path path on target , this does not include query parameters. example /myendpoint **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].rewrite\_to\_internal.query** `string` Query url query string to add to target example check\_limits=true **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].rewrite\_to\_internal.target** `object` API a namespaced/name to the api definition resource that you are targetting **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].rewrite\_to\_internal.target.name** `string` *required* k8s resource name **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].rewrite\_to\_internal.target.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[]** `object` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].on** `string` *required* **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options** `object` *required* **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.header\_matches** `object` Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.header\_matches.\{key}** `object` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.header\_matches.\{key}.match\_rx** `string` *required* **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.header\_matches.\{key}.reverse** `boolean` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.path\_part\_matches** `object` Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.path\_part\_matches.\{key}** `object` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.path\_part\_matches.\{key}.match\_rx** `string` *required* **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.path\_part\_matches.\{key}.reverse** `boolean` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.payload\_matches** `object` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.payload\_matches.match\_rx** `string` *required* **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.payload\_matches.reverse** `boolean` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.query\_val\_matches** `object` Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.query\_val\_matches.\{key}** `object` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.query\_val\_matches.\{key}.match\_rx** `string` *required* **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.query\_val\_matches.\{key}.reverse** `boolean` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.request\_context\_matches** `object` Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.request\_context\_matches.\{key}** `object` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.request\_context\_matches.\{key}.match\_rx** `string` *required* **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.request\_context\_matches.\{key}.reverse** `boolean` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.session\_meta\_matches** `object` Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.session\_meta\_matches.\{key}** `object` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.session\_meta\_matches.\{key}.match\_rx** `string` *required* **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].options.session\_meta\_matches.\{key}.reverse** `boolean` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].rewrite\_to** `string` **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].rewrite\_to\_internal** `object` RewriteToInternal defines options that constructs a url that refers to an api that is loaded into the gateway. **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].rewrite\_to\_internal.path** `string` Path path on target , this does not include query parameters. example /myendpoint **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].rewrite\_to\_internal.query** `string` Query url query string to add to target example check\_limits=true **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].rewrite\_to\_internal.target** `object` API a namespaced/name to the api definition resource that you are targetting **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].rewrite\_to\_internal.target.name** `string` *required* k8s resource name **version\_data.versions.\{key}.extended\_paths.url\_rewrites\[].triggers\[].rewrite\_to\_internal.target.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. **version\_data.versions.\{key}.extended\_paths.validate\_json\[]** `object` **version\_data.versions.\{key}.extended\_paths.validate\_json\[].error\_response\_code** `integer` *required* Allows override of default 422 Unprocessable Entity response code for validation errors. **version\_data.versions.\{key}.extended\_paths.validate\_json\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.validate\_json\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.validate\_json\[].schema** `object` *required* Schema represents schema field that verifies user requests against a specified JSON schema and check that the data sent to your API by a consumer is in the right format. Free-form object with arbitrary keys. **version\_data.versions.\{key}.extended\_paths.validate\_json\[].disabled** `boolean` **version\_data.versions.\{key}.extended\_paths.virtual\[]** `object` **version\_data.versions.\{key}.extended\_paths.virtual\[].function\_source\_type** `string` *required* **version\_data.versions.\{key}.extended\_paths.virtual\[].function\_source\_uri** `string` *required* **version\_data.versions.\{key}.extended\_paths.virtual\[].method** `string` *required* HttpMethod represents HTTP request method **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`, `CONNECT`, `TRACE`. **version\_data.versions.\{key}.extended\_paths.virtual\[].path** `string` *required* **version\_data.versions.\{key}.extended\_paths.virtual\[].proxy\_on\_error** `boolean` *required* **version\_data.versions.\{key}.extended\_paths.virtual\[].response\_function\_name** `string` *required* **version\_data.versions.\{key}.extended\_paths.virtual\[].use\_session** `boolean` *required* **version\_data.versions.\{key}.extended\_paths.white\_list\[]** `object` **version\_data.versions.\{key}.extended\_paths.white\_list\[].ignore\_case** `boolean` *required* **version\_data.versions.\{key}.extended\_paths.white\_list\[].method\_actions** `object` *required* Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.white\_list\[].method\_actions.\{key}** `object` **version\_data.versions.\{key}.extended\_paths.white\_list\[].method\_actions.\{key}.action** `string` *required* **version\_data.versions.\{key}.extended\_paths.white\_list\[].method\_actions.\{key}.code** `integer` *required* **version\_data.versions.\{key}.extended\_paths.white\_list\[].method\_actions.\{key}.data** `string` *required* **version\_data.versions.\{key}.extended\_paths.white\_list\[].method\_actions.\{key}.headers** `object` *required* Map of string keys to values. **version\_data.versions.\{key}.extended\_paths.white\_list\[].method\_actions.\{key}.headers.\{key}** `string` **version\_data.versions.\{key}.extended\_paths.white\_list\[].path** `string` *required* **version\_data.versions.\{key}.global\_headers** `object` Map of string keys to values. **version\_data.versions.\{key}.global\_headers.\{key}** `string` **version\_data.versions.\{key}.global\_headers\_remove\[]** `string` **version\_data.versions.\{key}.global\_response\_headers** `object` Map of string keys to values. **version\_data.versions.\{key}.global\_response\_headers.\{key}** `string` **version\_data.versions.\{key}.global\_response\_headers\_remove\[]** `string` **version\_data.versions.\{key}.global\_size\_limit** `integer` **version\_data.versions.\{key}.ignore\_endpoint\_case** `boolean` **version\_data.versions.\{key}.override\_target** `string` **version\_data.versions.\{key}.paths** `object` **version\_data.versions.\{key}.paths.black\_list\[]** `string` **version\_data.versions.\{key}.paths.ignored\[]** `string` **version\_data.versions.\{key}.paths.white\_list\[]** `string` **version\_data.versions.\{key}.use\_extended\_paths** `boolean` ## TykStreamsApiDefinition TykStreamsApiDefinitionSpec defines the desired state of TykStreamsApiDefinition ### tykStreams **tykStreams** `object` *required* TykStreams provides storage information about Tyk Streams **tykStreams.configmapRef** `object` *required* ConfigmapRef provides information of configmap in which Tyk Streams is stored **tykStreams.configmapRef.keyName** `string` *required* KeyName is the key of configmap in which Tyk OAS doc is stored **tykStreams.configmapRef.name** `string` *required* Name is the name of configmap **tykStreams.configmapRef.namespace** `string` Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource. ### contextRef **contextRef** `object` Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## TykMcpProxyDefinition TykMcpProxyDefinitionSpec defines the desired state of TykMcpProxyDefinition ### tykMCP **tykMCP** `object` *required* TykMCP provides storage information about MCP proxy configuration **tykMCP.configmapRef** `object` *required* ConfigmapRef provides information of configmap in which MCP OAS document is stored **tykMCP.configmapRef.keyName** `string` *required* KeyName is the key of configmap in which Tyk OAS doc is stored **tykMCP.configmapRef.name** `string` *required* Name is the name of configmap **tykMCP.configmapRef.namespace** `string` Namespace is the namespace of configmap. If Namespace is not provided, we assume that the ConfigMap is in the same namespace as TykOasApiDefinition resource. ### contextRef **contextRef** `object` Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## SecurityPolicy SecurityPolicySpec defines the desired state of SecurityPolicy ### Top-Level Fields **active** `boolean` *required* Active must be set to `true` for Tyk to load the security policy into memory. **name** `string` *required* Name represents the name of the security policy as displayed in the Dashboard **state** `string` *required* State can be active, draft or deny active: All keys are active and new keys can be created. draft: All keys are active but no new keys can be created. deny: All keys are deactivated and no keys can be created. **Allowed values:** `active`, `draft`, `deny`. **\_id** `string` MID ("\_id") is generated by Tyk once the resource is created. Do NOT fill this in. **enable\_http\_signature\_validation** `boolean` **hmac\_enabled** `boolean` **id** `string` If you are linking an existing Policy ID to a new YAML CRD, then fill in this ID field with the "\_id" field. See policies.md readme for more info **is\_inactive** `boolean` IsInactive applies to the key itself. Allows enabling or disabling the policy without deleting it. **key\_expires\_in** `integer` KeyExpiresIn is the number of seconds till key expiry. For 1 hour is 3600. Default never expire or 0 **max\_query\_depth** `integer` Max depth of a GraphQL query **org\_id** `string` OrgID is overwritten - no point setting this **per** `integer` To be used in conjunction with "Rate". Per seconds. 1 minute=60. 1 hour=3600 omit or "-1" for unlimited **quota\_max** `integer` Value of Quota allowed, omit or "-1" for unlimited **quota\_renewal\_rate** `integer` Value reset length, in seconds, omit or "-1" for unlimited **rate** `integer` Rate limit per X seconds (x="Per"), omit or "-1" for unlimited **tags\[]** `string` Custom tags to apply to the key, get transfered to the analytics **throttle\_interval** `integer` If rate limited, how many seconds to retry a request for. omit or "-1" for unlimited **throttle\_retry\_limit** `integer` Number of retries before returning error. omit or "-1" for unlimited ### access\_rights **access\_rights** `object` Map of string keys to values. **access\_rights.\{key}** `object` AccessDefinition defines which versions of an API a key has access to **access\_rights.\{key}.name** `string` *required* Name of the ApiDefinition resource to target **access\_rights.\{key}.allowance\_scope** `string` **access\_rights.\{key}.allowed\_types\[]** `object` Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key. **access\_rights.\{key}.allowed\_types\[].fields\[]** `string` *required* **access\_rights.\{key}.allowed\_types\[].name** `string` *required* **access\_rights.\{key}.allowed\_urls\[]** `object` AccessSpec defines what URLS a user has access to and what methods are enabled **access\_rights.\{key}.allowed\_urls\[].methods\[]** `string` *required* **access\_rights.\{key}.allowed\_urls\[].url** `string` *required* **access\_rights.\{key}.api\_id** `string` APIID is the ID of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually. **access\_rights.\{key}.api\_name** `string` APIName is the name of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually. **access\_rights.\{key}.disable\_introspection** `boolean` DisableIntrospection disables GraphQL introspection if it is set to True. **access\_rights.\{key}.endpoints\[]** `object` Endpoints is a collection of Endpoint. **access\_rights.\{key}.endpoints\[].methods\[]** `object` EndpointMethods is a collection of EndpointMethod. **access\_rights.\{key}.endpoints\[].methods\[].limit** `object` RateLimit holds rate limit configuration. **access\_rights.\{key}.endpoints\[].methods\[].limit.per** `string` *required* Per is the interval at which rate limit is enforced. **access\_rights.\{key}.endpoints\[].methods\[].limit.rate** `string` *required* Rate is the allowed number of requests per interval. **access\_rights.\{key}.endpoints\[].methods\[].limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **access\_rights.\{key}.endpoints\[].methods\[].limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **access\_rights.\{key}.endpoints\[].methods\[].limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **access\_rights.\{key}.endpoints\[].methods\[].limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **access\_rights.\{key}.endpoints\[].methods\[].limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **access\_rights.\{key}.endpoints\[].methods\[].limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **access\_rights.\{key}.endpoints\[].methods\[].name** `string` **access\_rights.\{key}.endpoints\[].path** `string` **access\_rights.\{key}.field\_access\_rights\[]** `object` FieldAccessRights is array of depth limit settings per GraphQL APIs. **access\_rights.\{key}.field\_access\_rights\[].field\_name** `string` FieldName represents the name of the Query or Mutation which the limit applies to. **access\_rights.\{key}.field\_access\_rights\[].limits** `object` Limit specifies the numerical value of the limit. **access\_rights.\{key}.field\_access\_rights\[].limits.max\_query\_depth** `integer` *required* MaxQueryDepth represents the numerical value of the limit. **access\_rights.\{key}.field\_access\_rights\[].type\_name** `string` TypeName points to a type on which depth limit is set. It can be either Query (most common case) or Mutation **access\_rights.\{key}.json\_rpc\_methods\[]** `object` JSONRPCMethods defines per-JSON-RPC-method rate limits. **access\_rights.\{key}.json\_rpc\_methods\[].limit** `object` RateLimit holds rate limit configuration. **access\_rights.\{key}.json\_rpc\_methods\[].limit.per** `string` *required* Per is the interval at which rate limit is enforced. **access\_rights.\{key}.json\_rpc\_methods\[].limit.rate** `string` *required* Rate is the allowed number of requests per interval. **access\_rights.\{key}.json\_rpc\_methods\[].limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **access\_rights.\{key}.json\_rpc\_methods\[].limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **access\_rights.\{key}.json\_rpc\_methods\[].limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **access\_rights.\{key}.json\_rpc\_methods\[].limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **access\_rights.\{key}.json\_rpc\_methods\[].limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **access\_rights.\{key}.json\_rpc\_methods\[].limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **access\_rights.\{key}.json\_rpc\_methods\[].name** `string` Name is the JSON-RPC method name (e.g., "tools/call", "resources/read"). **access\_rights.\{key}.json\_rpc\_methods\_access\_rights** `object` JSONRPCMethodsAccessRights defines allow/block lists for JSON-RPC methods. **access\_rights.\{key}.json\_rpc\_methods\_access\_rights.allowed\[]** `string` **access\_rights.\{key}.json\_rpc\_methods\_access\_rights.blocked\[]** `string` **access\_rights.\{key}.kind** `string` (default: ApiDefinition) Kind represents the kind of the linked API Definition resource. It can be either "ApiDefinition" or "TykOasApiDefinition" (case sensitive way). By default, Kind is set to "ApiDefinition". **Allowed values:** `ApiDefinition`, `TykOasApiDefinition`, `TykStreamsApiDefinition`, `TykMcpProxyDefinition`. **access\_rights.\{key}.limit** `object` APILimit stores quota and rate limit on ACL level (per API) **access\_rights.\{key}.limit.per** `integer` *required* **access\_rights.\{key}.limit.quota\_max** `integer` *required* **access\_rights.\{key}.limit.quota\_renewal\_rate** `integer` *required* **access\_rights.\{key}.limit.rate** `integer` *required* **access\_rights.\{key}.limit.throttle\_interval** `integer` *required* **access\_rights.\{key}.limit.throttle\_retry\_limit** `integer` *required* **access\_rights.\{key}.limit.max\_query\_depth** `integer` **access\_rights.\{key}.limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **access\_rights.\{key}.limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **access\_rights.\{key}.limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **access\_rights.\{key}.limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **access\_rights.\{key}.limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **access\_rights.\{key}.limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **access\_rights.\{key}.mcp\_access\_rights** `object` MCPAccessRights defines allow/block lists for MCP tools, resources, and prompts. **access\_rights.\{key}.mcp\_access\_rights.prompts** `object` AccessControlRules defines allow/block lists for access control. **access\_rights.\{key}.mcp\_access\_rights.prompts.allowed\[]** `string` **access\_rights.\{key}.mcp\_access\_rights.prompts.blocked\[]** `string` **access\_rights.\{key}.mcp\_access\_rights.resources** `object` AccessControlRules defines allow/block lists for access control. **access\_rights.\{key}.mcp\_access\_rights.resources.allowed\[]** `string` **access\_rights.\{key}.mcp\_access\_rights.resources.blocked\[]** `string` **access\_rights.\{key}.mcp\_access\_rights.tools** `object` AccessControlRules defines allow/block lists for access control. **access\_rights.\{key}.mcp\_access\_rights.tools.allowed\[]** `string` **access\_rights.\{key}.mcp\_access\_rights.tools.blocked\[]** `string` **access\_rights.\{key}.mcp\_primitives\[]** `object` MCPPrimitives defines per-primitive rate limits for MCP tools, resources, and prompts. **access\_rights.\{key}.mcp\_primitives\[].limit** `object` RateLimit holds rate limit configuration. **access\_rights.\{key}.mcp\_primitives\[].limit.per** `string` *required* Per is the interval at which rate limit is enforced. **access\_rights.\{key}.mcp\_primitives\[].limit.rate** `string` *required* Rate is the allowed number of requests per interval. **access\_rights.\{key}.mcp\_primitives\[].limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **access\_rights.\{key}.mcp\_primitives\[].limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **access\_rights.\{key}.mcp\_primitives\[].limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **access\_rights.\{key}.mcp\_primitives\[].limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **access\_rights.\{key}.mcp\_primitives\[].limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **access\_rights.\{key}.mcp\_primitives\[].limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **access\_rights.\{key}.mcp\_primitives\[].name** `string` Name is the primitive name (tool name, resource URI, or prompt name). **access\_rights.\{key}.mcp\_primitives\[].type** `string` Type is the MCP primitive type: "tool", "resource", or "prompt". **Allowed values:** `tool`, `resource`, `prompt`. **access\_rights.\{key}.namespace** `string` Namespace of the ApiDefinition resource to target. Optional: a controller that supports it (TykSession) defaults it to the referring resource's own namespace, which a required field would make unreachable. **access\_rights.\{key}.restricted\_types\[]** `object` Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key. **access\_rights.\{key}.restricted\_types\[].fields\[]** `string` *required* **access\_rights.\{key}.restricted\_types\[].name** `string` *required* **access\_rights.\{key}.versions\[]** `string` ### access\_rights\_array **access\_rights\_array\[]** `object` AccessDefinition defines which versions of an API a key has access to **access\_rights\_array\[].name** `string` *required* Name of the ApiDefinition resource to target **access\_rights\_array\[].allowance\_scope** `string` **access\_rights\_array\[].allowed\_types\[]** `object` Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key. **access\_rights\_array\[].allowed\_types\[].fields\[]** `string` *required* **access\_rights\_array\[].allowed\_types\[].name** `string` *required* **access\_rights\_array\[].allowed\_urls\[]** `object` AccessSpec defines what URLS a user has access to and what methods are enabled **access\_rights\_array\[].allowed\_urls\[].methods\[]** `string` *required* **access\_rights\_array\[].allowed\_urls\[].url** `string` *required* **access\_rights\_array\[].api\_id** `string` APIID is the ID of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually. **access\_rights\_array\[].api\_name** `string` APIName is the name of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually. **access\_rights\_array\[].disable\_introspection** `boolean` DisableIntrospection disables GraphQL introspection if it is set to True. **access\_rights\_array\[].endpoints\[]** `object` Endpoints is a collection of Endpoint. **access\_rights\_array\[].endpoints\[].methods\[]** `object` EndpointMethods is a collection of EndpointMethod. **access\_rights\_array\[].endpoints\[].methods\[].limit** `object` RateLimit holds rate limit configuration. **access\_rights\_array\[].endpoints\[].methods\[].limit.per** `string` *required* Per is the interval at which rate limit is enforced. **access\_rights\_array\[].endpoints\[].methods\[].limit.rate** `string` *required* Rate is the allowed number of requests per interval. **access\_rights\_array\[].endpoints\[].methods\[].limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **access\_rights\_array\[].endpoints\[].methods\[].limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **access\_rights\_array\[].endpoints\[].methods\[].limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **access\_rights\_array\[].endpoints\[].methods\[].limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **access\_rights\_array\[].endpoints\[].methods\[].limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **access\_rights\_array\[].endpoints\[].methods\[].limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **access\_rights\_array\[].endpoints\[].methods\[].name** `string` **access\_rights\_array\[].endpoints\[].path** `string` **access\_rights\_array\[].field\_access\_rights\[]** `object` FieldAccessRights is array of depth limit settings per GraphQL APIs. **access\_rights\_array\[].field\_access\_rights\[].field\_name** `string` FieldName represents the name of the Query or Mutation which the limit applies to. **access\_rights\_array\[].field\_access\_rights\[].limits** `object` Limit specifies the numerical value of the limit. **access\_rights\_array\[].field\_access\_rights\[].limits.max\_query\_depth** `integer` *required* MaxQueryDepth represents the numerical value of the limit. **access\_rights\_array\[].field\_access\_rights\[].type\_name** `string` TypeName points to a type on which depth limit is set. It can be either Query (most common case) or Mutation **access\_rights\_array\[].json\_rpc\_methods\[]** `object` JSONRPCMethods defines per-JSON-RPC-method rate limits. **access\_rights\_array\[].json\_rpc\_methods\[].limit** `object` RateLimit holds rate limit configuration. **access\_rights\_array\[].json\_rpc\_methods\[].limit.per** `string` *required* Per is the interval at which rate limit is enforced. **access\_rights\_array\[].json\_rpc\_methods\[].limit.rate** `string` *required* Rate is the allowed number of requests per interval. **access\_rights\_array\[].json\_rpc\_methods\[].limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **access\_rights\_array\[].json\_rpc\_methods\[].limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **access\_rights\_array\[].json\_rpc\_methods\[].limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **access\_rights\_array\[].json\_rpc\_methods\[].limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **access\_rights\_array\[].json\_rpc\_methods\[].limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **access\_rights\_array\[].json\_rpc\_methods\[].limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **access\_rights\_array\[].json\_rpc\_methods\[].name** `string` Name is the JSON-RPC method name (e.g., "tools/call", "resources/read"). **access\_rights\_array\[].json\_rpc\_methods\_access\_rights** `object` JSONRPCMethodsAccessRights defines allow/block lists for JSON-RPC methods. **access\_rights\_array\[].json\_rpc\_methods\_access\_rights.allowed\[]** `string` **access\_rights\_array\[].json\_rpc\_methods\_access\_rights.blocked\[]** `string` **access\_rights\_array\[].kind** `string` (default: ApiDefinition) Kind represents the kind of the linked API Definition resource. It can be either "ApiDefinition" or "TykOasApiDefinition" (case sensitive way). By default, Kind is set to "ApiDefinition". **Allowed values:** `ApiDefinition`, `TykOasApiDefinition`, `TykStreamsApiDefinition`, `TykMcpProxyDefinition`. **access\_rights\_array\[].limit** `object` APILimit stores quota and rate limit on ACL level (per API) **access\_rights\_array\[].limit.per** `integer` *required* **access\_rights\_array\[].limit.quota\_max** `integer` *required* **access\_rights\_array\[].limit.quota\_renewal\_rate** `integer` *required* **access\_rights\_array\[].limit.rate** `integer` *required* **access\_rights\_array\[].limit.throttle\_interval** `integer` *required* **access\_rights\_array\[].limit.throttle\_retry\_limit** `integer` *required* **access\_rights\_array\[].limit.max\_query\_depth** `integer` **access\_rights\_array\[].limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **access\_rights\_array\[].limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **access\_rights\_array\[].limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **access\_rights\_array\[].limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **access\_rights\_array\[].limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **access\_rights\_array\[].limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **access\_rights\_array\[].mcp\_access\_rights** `object` MCPAccessRights defines allow/block lists for MCP tools, resources, and prompts. **access\_rights\_array\[].mcp\_access\_rights.prompts** `object` AccessControlRules defines allow/block lists for access control. **access\_rights\_array\[].mcp\_access\_rights.prompts.allowed\[]** `string` **access\_rights\_array\[].mcp\_access\_rights.prompts.blocked\[]** `string` **access\_rights\_array\[].mcp\_access\_rights.resources** `object` AccessControlRules defines allow/block lists for access control. **access\_rights\_array\[].mcp\_access\_rights.resources.allowed\[]** `string` **access\_rights\_array\[].mcp\_access\_rights.resources.blocked\[]** `string` **access\_rights\_array\[].mcp\_access\_rights.tools** `object` AccessControlRules defines allow/block lists for access control. **access\_rights\_array\[].mcp\_access\_rights.tools.allowed\[]** `string` **access\_rights\_array\[].mcp\_access\_rights.tools.blocked\[]** `string` **access\_rights\_array\[].mcp\_primitives\[]** `object` MCPPrimitives defines per-primitive rate limits for MCP tools, resources, and prompts. **access\_rights\_array\[].mcp\_primitives\[].limit** `object` RateLimit holds rate limit configuration. **access\_rights\_array\[].mcp\_primitives\[].limit.per** `string` *required* Per is the interval at which rate limit is enforced. **access\_rights\_array\[].mcp\_primitives\[].limit.rate** `string` *required* Rate is the allowed number of requests per interval. **access\_rights\_array\[].mcp\_primitives\[].limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **access\_rights\_array\[].mcp\_primitives\[].limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **access\_rights\_array\[].mcp\_primitives\[].limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **access\_rights\_array\[].mcp\_primitives\[].limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **access\_rights\_array\[].mcp\_primitives\[].limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **access\_rights\_array\[].mcp\_primitives\[].limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **access\_rights\_array\[].mcp\_primitives\[].name** `string` Name is the primitive name (tool name, resource URI, or prompt name). **access\_rights\_array\[].mcp\_primitives\[].type** `string` Type is the MCP primitive type: "tool", "resource", or "prompt". **Allowed values:** `tool`, `resource`, `prompt`. **access\_rights\_array\[].namespace** `string` Namespace of the ApiDefinition resource to target. Optional: a controller that supports it (TykSession) defaults it to the referring resource's own namespace, which a required field would make unreachable. **access\_rights\_array\[].restricted\_types\[]** `object` Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key. **access\_rights\_array\[].restricted\_types\[].fields\[]** `string` *required* **access\_rights\_array\[].restricted\_types\[].name** `string` *required* **access\_rights\_array\[].versions\[]** `string` ### contextRef **contextRef** `object` Context specify namespace/name of the OperatorContext object used for reconciling this APIDefinition **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### meta\_data **meta\_data** `object` LastUpdated string `json:"last_updated"` **meta\_data.\{key}** `string` ### partitions **partitions** `object` **partitions.acl** `boolean` **partitions.complexity** `boolean` **partitions.per\_api** `boolean` **partitions.quota** `boolean` **partitions.rate\_limit** `boolean` ## APIDescription APIDescriptionSpec defines the desired state of APIDescription ### Top-Level Fields **auth\_type** `string` AuthType displays as a badge next to the name of the API **Allowed values:** `keyless`, `jwt`, `oauth`, `authToken`. **documentation** `string` Do not set Documentation. Use `docs` instead. **is\_keyless** `boolean` IsKeyless toggles visibility of the `Request an API Key button`. Use this when AuthType is keyless, jwt or oauth. **long\_description** `string` LongDescription can be markdown. It allows you to describe the capabilities of the API and is displayed just below the name and AuthType in the catalogue listing page. **name** `string` Name is the title of the API that you wish to be published to the catalogue **policy\_id** `string` PolicyID explicitly sets the policy\_id to be published. We do not recommend that this value is set directly. Rather, use `policyRef` instead. **short\_description** `string` ShortDescription is a brief summary of the API shown in the portal catalogue. Note that it may not be rendered by the default portal templates. **show** `boolean` Show toggles visibility of the API in the portal catalogue **version** `string` (default: v2) Version should always be v2 **Allowed values:** `v2`. ### config **config** `object` Config optionally overrides individual fields of the portal's PortalConfig for this catalogue. **config.catalogue\_login\_only** `boolean` CatalogueLoginOnly limits access to catalogues for login users only. **config.dcr\_options** `object` DCROptions dynamic client registration options. **config.dcr\_options.grant\_types\[]** `string` *required* GrantTypes is an array of OAuth 2.0 grant type strings that the client can use at the token endpoint. **Allowed values:** `client_credentials`, `authorization_code`, `refresh_token`. **config.dcr\_options.idp\_host** `string` *required* IDPHost is the fully qualified hostname of the Identity Provider. e.g. [https://mysubdomain.eu.auth0.com](https://mysubdomain.eu.auth0.com) **config.dcr\_options.registration\_endpoint** `string` *required* RegistrationEndpoint is the registration\_endpoint as presented in the /.well-known/openid-configuration document. **config.dcr\_options.token\_endpoint\_auth\_method** `string` *required* TokenEndpointAuthMethod is an indicator of the requested authentication method for the token endpoint. "none": The client is a public client and does not have a client secret. "client\_secret\_post": The client uses the HTTP POST parameters "client\_secret\_basic": The client uses HTTP Basic authentication **Allowed values:** `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `none`. **config.dcr\_options.access\_token** `string` AccessToken represents an optional bearer token to authenticate with against the registration endpoint **config.dcr\_options.provider** `string` Provider is an optional enum of the provider which allows Tyk to register clients outside the standard DCR spec and perform provider specific logic. If your provider is not in this list, please omit. Upon failure, submit a support ticket so that we may extend support for your provider. **Allowed values:** `gluu`, `keycloak`, `okta`. **config.dcr\_options.response\_types\[]** `string` ResponseTypes is an array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. **Allowed values:** `code`, `token`. **config.disable\_auto\_login** `boolean` **config.disable\_login** `boolean` DisableLogin disables login on developer portal.If you do not want developers to be able to login, set this value to true. You can use this configuration option in the portal templates to display or hide the login form as well as disabling the actual login method. **config.disable\_signup** `boolean` DisableSignup stop developer sign-up to the portal.This will stop developers from being able to signup, they will need to be created manually, or assigned keys via the key management API. **config.email** `string` **config.enable\_dcr** `boolean` EnableDCR activates dynamic client registration. **config.enable\_multi\_selection** `boolean` EnableMultiSelection enables subscribing to multiple APIs with single key.User will be able subscript any combination of exposed catalogues of the same authentication type **config.id** `string` Set by the server. DO NOT set this field it is read only. **config.key\_request\_fields\[]** `string` KeyRequestFields is a slice of fields which are asked of the portal developer when requesting an api key **config.mail\_options** `object` **config.mail\_options.email\_copy** `object` *required* **config.mail\_options.email\_copy.key\_email** `object` *required* **config.mail\_options.email\_copy.key\_email.body** `string` *required* **config.mail\_options.email\_copy.key\_email.enabled** `boolean` *required* **config.mail\_options.email\_copy.key\_email.hide\_token\_data** `boolean` *required* **config.mail\_options.email\_copy.key\_email.sign\_off** `string` *required* **config.mail\_options.email\_copy.key\_email.subject** `string` *required* **config.mail\_options.email\_copy.reset\_password\_email** `object` *required* **config.mail\_options.email\_copy.reset\_password\_email.body** `string` *required* **config.mail\_options.email\_copy.reset\_password\_email.enabled** `boolean` *required* **config.mail\_options.email\_copy.reset\_password\_email.hide\_token\_data** `boolean` *required* **config.mail\_options.email\_copy.reset\_password\_email.sign\_off** `string` *required* **config.mail\_options.email\_copy.reset\_password\_email.subject** `string` *required* **config.mail\_options.email\_copy.welcome\_email** `object` *required* **config.mail\_options.email\_copy.welcome\_email.body** `string` *required* **config.mail\_options.email\_copy.welcome\_email.enabled** `boolean` *required* **config.mail\_options.email\_copy.welcome\_email.hide\_token\_data** `boolean` *required* **config.mail\_options.email\_copy.welcome\_email.sign\_off** `string` *required* **config.mail\_options.email\_copy.welcome\_email.subject** `string` *required* **config.mail\_options.mail\_from\_email** `string` *required* **config.mail\_options.mail\_from\_name** `string` *required* **config.oauth\_usage\_limit** `integer` OAuthUsageLimit is the maximum permitted number of OAuth clients **config.org\_id** `string` OrgID is the organization ID **config.override** `boolean` Override overides global settings. These Catalogue settings are currently being overwritten by the Global Catalogue settings. Toggle the checkbox below to override them for this Catalogue. **config.redirect\_on\_key\_request** `boolean` RedirectOnKeyRequest redirects key requests. WHen set to true it will redirect key requests to the url specified in RedirectTo field **config.redirect\_to** `string` RedirectTo is a url used to redirect key requests **config.require\_key\_approval** `boolean` RequireKeyApproval requires reviewing of all key requests before approving them. By default developers will auto-enroll into an API and be given an API key. If you wish to review key requests before giving developers access to the API, enable this option and you will manually need to approve them in the 'Key requests' section of the dashboard. **config.secure\_key\_approval** `boolean` SecureKeyApproval enables Secure key approval.By default, API keys when approved are sent in an email to the Developer. By enabling this option, the Developer will instead receive a link where they can go to generate the API key securely **config.signup\_fields\[]** `string` SignUpFields is a slice of fields which are asked of the portal developer when they register for an account ### contextRef **contextRef** `object` **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### docs **docs** `object` **docs.doc\_type** `string` *required* **Allowed values:** `swagger`, `swagger_custom_url`, `graphql`. **docs.documentation** `string` ### fields **fields** `object` Fields is a generic map of key:value pairs. You may wish to use this to tag a catalogue as type:internal or type:public Then apply logic at the template layer to dynamically display catalogue apis to different user types. **fields.\{key}** `string` ### policyRef **policyRef** `object` **policyRef.name** `string` *required* k8s resource name **policyRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## OperatorContext OperatorContextSpec defines the desired state of OperatorContext ### env **env** `object` Env is the values of the admin api endpoint that the operator will use to reconcile resources **env.auth** `string` **env.ingress** `object` **env.ingress.httpPort** `integer` **env.ingress.httpsPort** `integer` **env.insecureSkipVerify** `boolean` **env.mode** `string` OperatorContextMode is the mode to which the admin api binding is done values are ce for community edition and pro for dashboard **Allowed values:** `ce`, `pro`. **env.org** `string` **env.url** `string` **env.user\_group\_owners\[]** `string` **env.user\_owners\[]** `string` ### secretRef **secretRef** `object` Reference to k8s secret resource that we load environment from. **secretRef.name** `string` *required* k8s resource name **secretRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## PortalAPICatalogue PortalAPICatalogueSpec defines the desired state of PortalAPICatalogue ### Top-Level Fields **email** `string` Email is Catalogue owner email address.Catalogue owner will be notified at this email address when an API subscription request is submitted or granted **org\_id** `string` OrgID is the organization ID ### apis **apis\[]** `object` APIDescriptionList is a list of PortalCatalogueDescription published on this PortalAPICatalogue **apis\[].apiDescriptionRef** `object` **apis\[].apiDescriptionRef.name** `string` *required* k8s resource name **apis\[].apiDescriptionRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. **apis\[].auth\_type** `string` AuthType displays as a badge next to the name of the API **Allowed values:** `keyless`, `jwt`, `oauth`, `authToken`. **apis\[].config** `object` Config optionally overrides individual fields of the portal's PortalConfig for this catalogue. **apis\[].config.catalogue\_login\_only** `boolean` CatalogueLoginOnly limits access to catalogues for login users only. **apis\[].config.dcr\_options** `object` DCROptions dynamic client registration options. **apis\[].config.dcr\_options.grant\_types\[]** `string` *required* GrantTypes is an array of OAuth 2.0 grant type strings that the client can use at the token endpoint. **Allowed values:** `client_credentials`, `authorization_code`, `refresh_token`. **apis\[].config.dcr\_options.idp\_host** `string` *required* IDPHost is the fully qualified hostname of the Identity Provider. e.g. [https://mysubdomain.eu.auth0.com](https://mysubdomain.eu.auth0.com) **apis\[].config.dcr\_options.registration\_endpoint** `string` *required* RegistrationEndpoint is the registration\_endpoint as presented in the /.well-known/openid-configuration document. **apis\[].config.dcr\_options.token\_endpoint\_auth\_method** `string` *required* TokenEndpointAuthMethod is an indicator of the requested authentication method for the token endpoint. "none": The client is a public client and does not have a client secret. "client\_secret\_post": The client uses the HTTP POST parameters "client\_secret\_basic": The client uses HTTP Basic authentication **Allowed values:** `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `none`. **apis\[].config.dcr\_options.access\_token** `string` AccessToken represents an optional bearer token to authenticate with against the registration endpoint **apis\[].config.dcr\_options.provider** `string` Provider is an optional enum of the provider which allows Tyk to register clients outside the standard DCR spec and perform provider specific logic. If your provider is not in this list, please omit. Upon failure, submit a support ticket so that we may extend support for your provider. **Allowed values:** `gluu`, `keycloak`, `okta`. **apis\[].config.dcr\_options.response\_types\[]** `string` ResponseTypes is an array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. **Allowed values:** `code`, `token`. **apis\[].config.disable\_auto\_login** `boolean` **apis\[].config.disable\_login** `boolean` DisableLogin disables login on developer portal.If you do not want developers to be able to login, set this value to true. You can use this configuration option in the portal templates to display or hide the login form as well as disabling the actual login method. **apis\[].config.disable\_signup** `boolean` DisableSignup stop developer sign-up to the portal.This will stop developers from being able to signup, they will need to be created manually, or assigned keys via the key management API. **apis\[].config.email** `string` **apis\[].config.enable\_dcr** `boolean` EnableDCR activates dynamic client registration. **apis\[].config.enable\_multi\_selection** `boolean` EnableMultiSelection enables subscribing to multiple APIs with single key.User will be able subscript any combination of exposed catalogues of the same authentication type **apis\[].config.id** `string` Set by the server. DO NOT set this field it is read only. **apis\[].config.key\_request\_fields\[]** `string` KeyRequestFields is a slice of fields which are asked of the portal developer when requesting an api key **apis\[].config.mail\_options** `object` **apis\[].config.mail\_options.email\_copy** `object` *required* **apis\[].config.mail\_options.email\_copy.key\_email** `object` *required* **apis\[].config.mail\_options.email\_copy.key\_email.body** `string` *required* **apis\[].config.mail\_options.email\_copy.key\_email.enabled** `boolean` *required* **apis\[].config.mail\_options.email\_copy.key\_email.hide\_token\_data** `boolean` *required* **apis\[].config.mail\_options.email\_copy.key\_email.sign\_off** `string` *required* **apis\[].config.mail\_options.email\_copy.key\_email.subject** `string` *required* **apis\[].config.mail\_options.email\_copy.reset\_password\_email** `object` *required* **apis\[].config.mail\_options.email\_copy.reset\_password\_email.body** `string` *required* **apis\[].config.mail\_options.email\_copy.reset\_password\_email.enabled** `boolean` *required* **apis\[].config.mail\_options.email\_copy.reset\_password\_email.hide\_token\_data** `boolean` *required* **apis\[].config.mail\_options.email\_copy.reset\_password\_email.sign\_off** `string` *required* **apis\[].config.mail\_options.email\_copy.reset\_password\_email.subject** `string` *required* **apis\[].config.mail\_options.email\_copy.welcome\_email** `object` *required* **apis\[].config.mail\_options.email\_copy.welcome\_email.body** `string` *required* **apis\[].config.mail\_options.email\_copy.welcome\_email.enabled** `boolean` *required* **apis\[].config.mail\_options.email\_copy.welcome\_email.hide\_token\_data** `boolean` *required* **apis\[].config.mail\_options.email\_copy.welcome\_email.sign\_off** `string` *required* **apis\[].config.mail\_options.email\_copy.welcome\_email.subject** `string` *required* **apis\[].config.mail\_options.mail\_from\_email** `string` *required* **apis\[].config.mail\_options.mail\_from\_name** `string` *required* **apis\[].config.oauth\_usage\_limit** `integer` OAuthUsageLimit is the maximum permitted number of OAuth clients **apis\[].config.org\_id** `string` OrgID is the organization ID **apis\[].config.override** `boolean` Override overides global settings. These Catalogue settings are currently being overwritten by the Global Catalogue settings. Toggle the checkbox below to override them for this Catalogue. **apis\[].config.redirect\_on\_key\_request** `boolean` RedirectOnKeyRequest redirects key requests. WHen set to true it will redirect key requests to the url specified in RedirectTo field **apis\[].config.redirect\_to** `string` RedirectTo is a url used to redirect key requests **apis\[].config.require\_key\_approval** `boolean` RequireKeyApproval requires reviewing of all key requests before approving them. By default developers will auto-enroll into an API and be given an API key. If you wish to review key requests before giving developers access to the API, enable this option and you will manually need to approve them in the 'Key requests' section of the dashboard. **apis\[].config.secure\_key\_approval** `boolean` SecureKeyApproval enables Secure key approval.By default, API keys when approved are sent in an email to the Developer. By enabling this option, the Developer will instead receive a link where they can go to generate the API key securely **apis\[].config.signup\_fields\[]** `string` SignUpFields is a slice of fields which are asked of the portal developer when they register for an account **apis\[].docs** `object` **apis\[].docs.doc\_type** `string` *required* **Allowed values:** `swagger`, `swagger_custom_url`, `graphql`. **apis\[].docs.documentation** `string` **apis\[].documentation** `string` Do not set Documentation. Use `docs` instead. **apis\[].fields** `object` Fields is a generic map of key:value pairs. You may wish to use this to tag a catalogue as type:internal or type:public Then apply logic at the template layer to dynamically display catalogue apis to different user types. **apis\[].fields.\{key}** `string` **apis\[].is\_keyless** `boolean` IsKeyless toggles visibility of the `Request an API Key button`. Use this when AuthType is keyless, jwt or oauth. **apis\[].long\_description** `string` LongDescription can be markdown. It allows you to describe the capabilities of the API and is displayed just below the name and AuthType in the catalogue listing page. **apis\[].name** `string` Name is the title of the API that you wish to be published to the catalogue **apis\[].policy\_id** `string` PolicyID explicitly sets the policy\_id to be published. We do not recommend that this value is set directly. Rather, use `policyRef` instead. **apis\[].policyRef** `object` **apis\[].policyRef.name** `string` *required* k8s resource name **apis\[].policyRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. **apis\[].short\_description** `string` ShortDescription is a brief summary of the API shown in the portal catalogue. Note that it may not be rendered by the default portal templates. **apis\[].show** `boolean` Show toggles visibility of the API in the portal catalogue **apis\[].version** `string` (default: v2) Version should always be v2 **Allowed values:** `v2`. ### contextRef **contextRef** `object` Context is reference to OperatorContext resource. Set this if you want to target a specific OperatorContext. When omitted default OperatorContext is used. **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## PortalConfig PortalConfigSpec defines the desired state of PortalConfig ### Top-Level Fields **catalogue\_login\_only** `boolean` CatalogueLoginOnly limits access to catalogues for login users only. **disable\_auto\_login** `boolean` **disable\_login** `boolean` DisableLogin disables login on developer portal.If you do not want developers to be able to login, set this value to true. You can use this configuration option in the portal templates to display or hide the login form as well as disabling the actual login method. **disable\_signup** `boolean` DisableSignup stop developer sign-up to the portal.This will stop developers from being able to signup, they will need to be created manually, or assigned keys via the key management API. **email** `string` **enable\_dcr** `boolean` EnableDCR activates dynamic client registration. **enable\_multi\_selection** `boolean` EnableMultiSelection enables subscribing to multiple APIs with single key.User will be able subscript any combination of exposed catalogues of the same authentication type **id** `string` Set by the server. DO NOT set this field it is read only. **key\_request\_fields\[]** `string` KeyRequestFields is a slice of fields which are asked of the portal developer when requesting an api key **oauth\_usage\_limit** `integer` OAuthUsageLimit is the maximum permitted number of OAuth clients **org\_id** `string` OrgID is the organization ID **override** `boolean` Override overides global settings. These Catalogue settings are currently being overwritten by the Global Catalogue settings. Toggle the checkbox below to override them for this Catalogue. **redirect\_on\_key\_request** `boolean` RedirectOnKeyRequest redirects key requests. WHen set to true it will redirect key requests to the url specified in RedirectTo field **redirect\_to** `string` RedirectTo is a url used to redirect key requests **require\_key\_approval** `boolean` RequireKeyApproval requires reviewing of all key requests before approving them. By default developers will auto-enroll into an API and be given an API key. If you wish to review key requests before giving developers access to the API, enable this option and you will manually need to approve them in the 'Key requests' section of the dashboard. **secure\_key\_approval** `boolean` SecureKeyApproval enables Secure key approval.By default, API keys when approved are sent in an email to the Developer. By enabling this option, the Developer will instead receive a link where they can go to generate the API key securely **signup\_fields\[]** `string` SignUpFields is a slice of fields which are asked of the portal developer when they register for an account ### contextRef **contextRef** `object` **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### dcr\_options **dcr\_options** `object` DCROptions dynamic client registration options. **dcr\_options.grant\_types\[]** `string` *required* GrantTypes is an array of OAuth 2.0 grant type strings that the client can use at the token endpoint. **Allowed values:** `client_credentials`, `authorization_code`, `refresh_token`. **dcr\_options.idp\_host** `string` *required* IDPHost is the fully qualified hostname of the Identity Provider. e.g. [https://mysubdomain.eu.auth0.com](https://mysubdomain.eu.auth0.com) **dcr\_options.registration\_endpoint** `string` *required* RegistrationEndpoint is the registration\_endpoint as presented in the /.well-known/openid-configuration document. **dcr\_options.token\_endpoint\_auth\_method** `string` *required* TokenEndpointAuthMethod is an indicator of the requested authentication method for the token endpoint. "none": The client is a public client and does not have a client secret. "client\_secret\_post": The client uses the HTTP POST parameters "client\_secret\_basic": The client uses HTTP Basic authentication **Allowed values:** `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `none`. **dcr\_options.access\_token** `string` AccessToken represents an optional bearer token to authenticate with against the registration endpoint **dcr\_options.provider** `string` Provider is an optional enum of the provider which allows Tyk to register clients outside the standard DCR spec and perform provider specific logic. If your provider is not in this list, please omit. Upon failure, submit a support ticket so that we may extend support for your provider. **Allowed values:** `gluu`, `keycloak`, `okta`. **dcr\_options.response\_types\[]** `string` ResponseTypes is an array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. **Allowed values:** `code`, `token`. ### mail\_options **mail\_options** `object` **mail\_options.email\_copy** `object` *required* **mail\_options.email\_copy.key\_email** `object` *required* **mail\_options.email\_copy.key\_email.body** `string` *required* **mail\_options.email\_copy.key\_email.enabled** `boolean` *required* **mail\_options.email\_copy.key\_email.hide\_token\_data** `boolean` *required* **mail\_options.email\_copy.key\_email.sign\_off** `string` *required* **mail\_options.email\_copy.key\_email.subject** `string` *required* **mail\_options.email\_copy.reset\_password\_email** `object` *required* **mail\_options.email\_copy.reset\_password\_email.body** `string` *required* **mail\_options.email\_copy.reset\_password\_email.enabled** `boolean` *required* **mail\_options.email\_copy.reset\_password\_email.hide\_token\_data** `boolean` *required* **mail\_options.email\_copy.reset\_password\_email.sign\_off** `string` *required* **mail\_options.email\_copy.reset\_password\_email.subject** `string` *required* **mail\_options.email\_copy.welcome\_email** `object` *required* **mail\_options.email\_copy.welcome\_email.body** `string` *required* **mail\_options.email\_copy.welcome\_email.enabled** `boolean` *required* **mail\_options.email\_copy.welcome\_email.hide\_token\_data** `boolean` *required* **mail\_options.email\_copy.welcome\_email.sign\_off** `string` *required* **mail\_options.email\_copy.welcome\_email.subject** `string` *required* **mail\_options.mail\_from\_email** `string` *required* **mail\_options.mail\_from\_name** `string` *required* ## SubGraph SubGraphSpec defines the desired state of SubGraph ### Top-Level Fields **schema** `string` *required* **sdl** `string` *required* ## SuperGraph SuperGraphSpec defines the desired state of SuperGraph ### Top-Level Fields **merged\_sdl** `string` **schema** `string` ### subgraph\_refs **subgraph\_refs\[]** `object` *required* **subgraph\_refs\[].name** `string` *required* k8s resource name **subgraph\_refs\[].namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## TykCertificate TykCertificateSpec defines the desired state of TykCertificate. ### certificateSecretRef **certificateSecretRef** `object` *required* CertificateSecretRef references a same-namespace Kubernetes TLS Secret (type kubernetes.io/tls) holding the certificate in tls.crt and its private key in tls.key. The Secret is the single source of truth for the certificate; the operator only reads it and never writes to or deletes it. **certificateSecretRef.name** `string` *required* Name is the name of the TLS Secret. **certificateSecretRef.namespace** `string` Namespace is the namespace of the Secret. When empty the TykCertificate's own namespace is assumed; a cross-namespace reference is rejected by the admission webhook (a TLS Secret is same-namespace only, like every operator input Secret). ### contextRef **contextRef** `object` Context specifies namespace/name of the OperatorContext object used for reconciling this TykCertificate. It defaults to the TykCertificate's own namespace; an OperatorContext in another namespace may only be referenced when it opts in with the label tyk.tyk.io/allow-cross-namespace: "true". The reference is immutable; create a new certificate to target another backend context. **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## TykIdentityProfile TykIdentityProfileSpec defines the desired state of TykIdentityProfile. A TykIdentityProfile is a declarative Tyk Identity Broker (TIB) profile stored by the (embedded) Dashboard. It pairs a Provider (providerName + providerConfig) with an Action (actionType + identityHandlerConfig). The two config blocks are genuinely schemaless per provider, so they are carried as free-form JSON; secret leaves may reference a same-namespace Secret with the \$\{secretName:key} placeholder syntax (resolved in memory at reconcile time and never written back to the CR, status, events or logs). ### Top-Level Fields **actionType** `string` *required* ActionType selects what to do once an external identity is confirmed. **Allowed values:** `GenerateOrLoginDeveloperProfile`, `GenerateOrLoginUserProfile`, `GenerateOAuthTokenForClient`, `GenerateTemporaryAuthToken`, `GenerateOAuthTokenForPassword`. **providerConfig** `object` *required* ProviderConfig is the free-form, provider-specific configuration. Required. Secret leaves may use the \$\{secretName:key} placeholder to pull a value from a same-namespace Secret at reconcile time. **providerName** `string` *required* ProviderName selects the provider implementation (e.g. SocialProvider, ADProvider, SAMLProvider, ProxyProvider). Required, non-empty. **type** `string` *required* Type is the provider type. **Allowed values:** `passthrough`, `redirect`. **customEmailField** `string` CustomEmailField overrides the claim used as the identity email. **customUserGroupField** `string` CustomUserGroupField is the IdP claim carrying the user's group(s). It is the missing half of userGroupMapping: without it the broker has no claim to read group names from, so the mapping is inert. Broker payload, not operator scoping. **customUserIDField** `string` CustomUserIDField overrides the claim used as the identity user id. **customUserOrgField** `string` CustomUserOrgField is the IdP claim carrying the tenant/organisation, used by the broker to route a login to a Tyk organisation at login time (multi-org SSO). It is broker login-time routing payload (same category as userGroupMapping), NOT this profile's owning org: it does not set or override spec/status org identity. When set, defaultOrgID is required. **defaultOrgID** `string` DefaultOrgID is the fallback Tyk organisation id (24-char hex ObjectId) the broker routes a login to when the customUserOrgField claim is absent or unmapped. Required whenever customUserOrgField is set, so an unmapped login never resolves to no organisation. It is a login-time routing target, not this profile's owning org. **defaultUserGroupID** `string` DefaultUserGroupID is the fallback Tyk user group id for the minted session. It is a public identifier (like a pol\_id), not a secret. **identityHandlerConfig** `object` IdentityHandlerConfig is the free-form action/handler configuration. The Dashboard injects DashboardCredential server-side, so it must not be set here; secret leaves may use the \$\{secretName:key} placeholder. **name** `string` ProfileName is the human-readable Name stored on the profile. Defaults to the CR name when empty. **returnURL** `string` ReturnURL is the post-auth redirect URL. **ssoOnlyForRegisteredUsers** `boolean` SSOOnlyForRegisteredUsers restricts SSO to already-registered users. **userGroupSeparator** `string` UserGroupSeparator splits a multi-valued group claim (e.g. "," when the IdP packs several groups into one claim value) before userGroupMapping is applied. ### apiRef **apiRef** `object` APIRef references an ApiDefinition or TykOasApiDefinition; it is resolved to the API's Tyk api\_id and injected into identityHandlerConfig.BaseAPIID. Optional, same-namespace only. **apiRef.name** `string` *required* k8s resource name **apiRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### contextRef **contextRef** `object` Context specifies namespace/name of the OperatorContext used for reconciling this profile. It defaults to the profile's own namespace; an OperatorContext in another namespace may only be referenced when it opts in with the label tyk.tyk.io/allow-cross-namespace: "true". The reference is immutable; create a new profile to target another backend context. **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### matchedPolicyRef **matchedPolicyRef** `object` MatchedPolicyRef references a SecurityPolicy applied to the minted session; it is resolved to the policy's pol\_id. Optional, same-namespace only. **matchedPolicyRef.name** `string` *required* k8s resource name **matchedPolicyRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### orgMapping **orgMapping** `object` OrgMapping maps a customUserOrgField claim value to a Tyk organisation id (a 24-char hex ObjectId). Keys are opaque claim values; values are login-time routing targets, broker payload in the same category as userGroupMapping — they are NOT this profile's owning org. **orgMapping.\{key}** `string` ### providerConstraints **providerConstraints** `object` ProviderConstraints optionally limits logins by domain and/or group. **providerConstraints.domain** `string` Domain restricts logins to identities from this domain. **providerConstraints.group** `string` Group restricts logins to identities in this group. ### userGroupMapping **userGroupMapping** `object` UserGroupMapping maps external group names to Tyk user group ids. **userGroupMapping.\{key}** `string` ## TykOAuthClient TykOAuthClientSpec defines the desired state of TykOAuthClient. ### Top-Level Fields **clientID** `string` ClientID is a custom (bring-your-own) client\_id. Immutable once set. When empty, Tyk generates the client\_id. **description** `string` Description is a human-readable description of the client. **redirectURI** `string` RedirectURI is the allowed OAuth redirect URI. Optional, but the client\_credentials grant needs one: the Gateway refuses every token grant while it is empty. If set, it must be a valid absolute URL. ### apiRef **apiRef** `object` *required* APIRef references the OAuth2-enabled ApiDefinition or TykOasApiDefinition the client is bound to, by metadata.name; it is resolved to the API's Tyk api\_id. Required, and must live in the same namespace as the TykOAuthClient. **apiRef.name** `string` *required* k8s resource name **apiRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### contextRef **contextRef** `object` Context specifies namespace/name of the OperatorContext object used for reconciling this TykOAuthClient. It defaults to the TykOAuthClient's own namespace; an OperatorContext in another namespace may only be referenced when it opts in with the label tyk.tyk.io/allow-cross-namespace: "true". The reference is immutable; create a new client to target another backend context. **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### credentialSecretRef **credentialSecretRef** `object` CredentialSecretRef references a Secret holding the user-supplied client\_secret. Must be in the same namespace as the TykOAuthClient. When empty, Tyk generates the secret. The client\_secret is honoured only at CREATE. Tyk ignores a submitted client\_secret on update (both the Gateway's updateOauthClient and the Dashboard, which proxies to it, reuse the stored secret), so rotating the referenced Secret does NOT change the live client's secret - the operator emits a Warning "BYOSecretRotationIgnored" event when it detects this. To change the secret, delete and re-apply the TykOAuthClient. **credentialSecretRef.keyName** `string` *required* KeyName is the key of secret in which Tyk OAS doc is stored **credentialSecretRef.name** `string` *required* Name is the name of the secret **credentialSecretRef.namespace** `string` Namespace is the namespace of secret. If Namespace is not provided, we assume that the secret is in the same namespace as TykOasApiDefinition resource. ### metaData **metaData** `object` MetaData is arbitrary metadata stamped onto sessions issued for the client. **metaData.\{key}** `string` ### policyRef **policyRef** `object` PolicyRef references a SecurityPolicy applied to tokens issued for this client; it is resolved to the policy's pol\_id. Optional, same-namespace. Be aware that the client\_credentials grant requires a policy: the gateway builds each token's session from the client's policy, so a client provisioned without one reports Successful but every client\_credentials token request fails with server\_error (verified on Tyk Pro 5.8.14). Changing policyRef to a different policy on an already-provisioned client is not free: Tyk invalidates every live access token issued for this client the moment the policy binding changes (gateway invalidateTokens). The operator emits a Normal "PolicyChanged" event when a reconcile changes the resolved policy so the blast radius is visible in `kubectl describe`. **policyRef.name** `string` *required* k8s resource name **policyRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### writeToSecretRef **writeToSecretRef** `object` WriteToSecretRef names the operator-owned Secret the resulting client\_id and client\_secret are written to. Must be in the same namespace as the TykOAuthClient. Defaults to \-tyk-oauth. **writeToSecretRef.name** `string` *required* k8s resource name **writeToSecretRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## TykRuleset TykRuleset is the Schema for the tykrulesets API. ### Top-Level Fields **name** `string` *required* Name is the Dashboard-visible name of the ruleset. **action** `string` (default: none) Action governs what happens when the Operator finds violations for this ruleset. **Allowed values:** `none`, `warn`, `block`. **active** `boolean` Active toggles enforcement. Defaults to false. **categories\[]** `string` Categories scopes this ruleset for evaluation. **description** `string` Description is the free-text description. **resourceType** `string` (default: oas-api) ResourceType is what this ruleset applies to. **Allowed values:** `oas-api`, `mcp-api`. ### ruleset **ruleset** `object` *required* Ruleset is the source of the Spectral JSON/YAML body. Exactly one of raw or objRef must be set. **ruleset.objRef** `object` ObjRef points at a ConfigMap or Secret whose data\[keyName] holds the Spectral JSON/YAML body. **ruleset.objRef.keyName** `string` *required* KeyName is the data key holding the ruleset body. **ruleset.objRef.kind** `string` *required* Kind is the referenced object kind. **Allowed values:** `ConfigMap`, `Secret`. **ruleset.objRef.name** `string` *required* Name is the object name. **ruleset.objRef.namespace** `string` Namespace must be omitted; cross-namespace references are not permitted. **ruleset.raw** `string` Raw is the Spectral JSON/YAML body inlined in the CR. ### contextRef **contextRef** `object` Context overrides the OperatorContext used for this resource. **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## TykSession TykSessionSpec defines the desired state of TykSession ### Top-Level Fields **alias** `string` Alias is a human-readable name for the key, shown in the Dashboard. **expires** `integer` Expires is the key expiry as a Unix timestamp. 0 means never. **keyID** `string` KeyID is a custom (bring-your-own) key ID. Immutable once set. When empty, Tyk generates the key ID. **per** `integer` Per is the rate-limit window, in seconds. **quotaMax** `integer` QuotaMax is the maximum number of requests allowed in a quota period. -1 for unlimited. **quotaRenewalRate** `integer` QuotaRenewalRate is the quota period, in seconds. **rate** `integer` Rate is the number of requests allowed per Per seconds. **tags\[]** `string` Tags are analytics tags attached to the key. **type** `string` (default: token) Type is the authentication mode of the key. Immutable. **Allowed values:** `token`, `basicAuth`. ### accessRights **accessRights** `object` AccessRights grants direct (policy-less) access to APIs, keyed by an arbitrary identifier. They must reference resources in the same namespace as the TykSession. **accessRights.\{key}** `object` AccessDefinition defines which versions of an API a key has access to **accessRights.\{key}.name** `string` *required* Name of the ApiDefinition resource to target **accessRights.\{key}.allowance\_scope** `string` **accessRights.\{key}.allowed\_types\[]** `object` Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key. **accessRights.\{key}.allowed\_types\[].fields\[]** `string` *required* **accessRights.\{key}.allowed\_types\[].name** `string` *required* **accessRights.\{key}.allowed\_urls\[]** `object` AccessSpec defines what URLS a user has access to and what methods are enabled **accessRights.\{key}.allowed\_urls\[].methods\[]** `string` *required* **accessRights.\{key}.allowed\_urls\[].url** `string` *required* **accessRights.\{key}.api\_id** `string` APIID is the ID of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually. **accessRights.\{key}.api\_name** `string` APIName is the name of the API this access rule grants access to. It is normally resolved automatically from the referenced ApiDefinition resource, so you do not usually need to set it manually. **accessRights.\{key}.disable\_introspection** `boolean` DisableIntrospection disables GraphQL introspection if it is set to True. **accessRights.\{key}.endpoints\[]** `object` Endpoints is a collection of Endpoint. **accessRights.\{key}.endpoints\[].methods\[]** `object` EndpointMethods is a collection of EndpointMethod. **accessRights.\{key}.endpoints\[].methods\[].limit** `object` RateLimit holds rate limit configuration. **accessRights.\{key}.endpoints\[].methods\[].limit.per** `string` *required* Per is the interval at which rate limit is enforced. **accessRights.\{key}.endpoints\[].methods\[].limit.rate** `string` *required* Rate is the allowed number of requests per interval. **accessRights.\{key}.endpoints\[].methods\[].limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **accessRights.\{key}.endpoints\[].methods\[].limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **accessRights.\{key}.endpoints\[].methods\[].limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **accessRights.\{key}.endpoints\[].methods\[].limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **accessRights.\{key}.endpoints\[].methods\[].limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **accessRights.\{key}.endpoints\[].methods\[].limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **accessRights.\{key}.endpoints\[].methods\[].name** `string` **accessRights.\{key}.endpoints\[].path** `string` **accessRights.\{key}.field\_access\_rights\[]** `object` FieldAccessRights is array of depth limit settings per GraphQL APIs. **accessRights.\{key}.field\_access\_rights\[].field\_name** `string` FieldName represents the name of the Query or Mutation which the limit applies to. **accessRights.\{key}.field\_access\_rights\[].limits** `object` Limit specifies the numerical value of the limit. **accessRights.\{key}.field\_access\_rights\[].limits.max\_query\_depth** `integer` *required* MaxQueryDepth represents the numerical value of the limit. **accessRights.\{key}.field\_access\_rights\[].type\_name** `string` TypeName points to a type on which depth limit is set. It can be either Query (most common case) or Mutation **accessRights.\{key}.json\_rpc\_methods\[]** `object` JSONRPCMethods defines per-JSON-RPC-method rate limits. **accessRights.\{key}.json\_rpc\_methods\[].limit** `object` RateLimit holds rate limit configuration. **accessRights.\{key}.json\_rpc\_methods\[].limit.per** `string` *required* Per is the interval at which rate limit is enforced. **accessRights.\{key}.json\_rpc\_methods\[].limit.rate** `string` *required* Rate is the allowed number of requests per interval. **accessRights.\{key}.json\_rpc\_methods\[].limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **accessRights.\{key}.json\_rpc\_methods\[].limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **accessRights.\{key}.json\_rpc\_methods\[].limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **accessRights.\{key}.json\_rpc\_methods\[].limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **accessRights.\{key}.json\_rpc\_methods\[].limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **accessRights.\{key}.json\_rpc\_methods\[].limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **accessRights.\{key}.json\_rpc\_methods\[].name** `string` Name is the JSON-RPC method name (e.g., "tools/call", "resources/read"). **accessRights.\{key}.json\_rpc\_methods\_access\_rights** `object` JSONRPCMethodsAccessRights defines allow/block lists for JSON-RPC methods. **accessRights.\{key}.json\_rpc\_methods\_access\_rights.allowed\[]** `string` **accessRights.\{key}.json\_rpc\_methods\_access\_rights.blocked\[]** `string` **accessRights.\{key}.kind** `string` (default: ApiDefinition) Kind represents the kind of the linked API Definition resource. It can be either "ApiDefinition" or "TykOasApiDefinition" (case sensitive way). By default, Kind is set to "ApiDefinition". **Allowed values:** `ApiDefinition`, `TykOasApiDefinition`, `TykStreamsApiDefinition`, `TykMcpProxyDefinition`. **accessRights.\{key}.limit** `object` APILimit stores quota and rate limit on ACL level (per API) **accessRights.\{key}.limit.per** `integer` *required* **accessRights.\{key}.limit.quota\_max** `integer` *required* **accessRights.\{key}.limit.quota\_renewal\_rate** `integer` *required* **accessRights.\{key}.limit.rate** `integer` *required* **accessRights.\{key}.limit.throttle\_interval** `integer` *required* **accessRights.\{key}.limit.throttle\_retry\_limit** `integer` *required* **accessRights.\{key}.limit.max\_query\_depth** `integer` **accessRights.\{key}.limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **accessRights.\{key}.limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **accessRights.\{key}.limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **accessRights.\{key}.limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **accessRights.\{key}.limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **accessRights.\{key}.limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **accessRights.\{key}.mcp\_access\_rights** `object` MCPAccessRights defines allow/block lists for MCP tools, resources, and prompts. **accessRights.\{key}.mcp\_access\_rights.prompts** `object` AccessControlRules defines allow/block lists for access control. **accessRights.\{key}.mcp\_access\_rights.prompts.allowed\[]** `string` **accessRights.\{key}.mcp\_access\_rights.prompts.blocked\[]** `string` **accessRights.\{key}.mcp\_access\_rights.resources** `object` AccessControlRules defines allow/block lists for access control. **accessRights.\{key}.mcp\_access\_rights.resources.allowed\[]** `string` **accessRights.\{key}.mcp\_access\_rights.resources.blocked\[]** `string` **accessRights.\{key}.mcp\_access\_rights.tools** `object` AccessControlRules defines allow/block lists for access control. **accessRights.\{key}.mcp\_access\_rights.tools.allowed\[]** `string` **accessRights.\{key}.mcp\_access\_rights.tools.blocked\[]** `string` **accessRights.\{key}.mcp\_primitives\[]** `object` MCPPrimitives defines per-primitive rate limits for MCP tools, resources, and prompts. **accessRights.\{key}.mcp\_primitives\[].limit** `object` RateLimit holds rate limit configuration. **accessRights.\{key}.mcp\_primitives\[].limit.per** `string` *required* Per is the interval at which rate limit is enforced. **accessRights.\{key}.mcp\_primitives\[].limit.rate** `string` *required* Rate is the allowed number of requests per interval. **accessRights.\{key}.mcp\_primitives\[].limit.smoothing** `object` Smoothing contains rate limit smoothing settings. **accessRights.\{key}.mcp\_primitives\[].limit.smoothing.enabled** `boolean` *required* Enabled indicates if rate limit smoothing is active. **accessRights.\{key}.mcp\_primitives\[].limit.smoothing.delay** `integer` Delay is the minimum time between rate limit changes (in seconds). **accessRights.\{key}.mcp\_primitives\[].limit.smoothing.step** `integer` Step is the increment/decrement for adjusting the rate limit. **accessRights.\{key}.mcp\_primitives\[].limit.smoothing.threshold** `integer` Threshold is the request rate above which smoothing is applied. **accessRights.\{key}.mcp\_primitives\[].limit.smoothing.trigger** `string` Trigger is the step factor determining when smoothing events trigger. **accessRights.\{key}.mcp\_primitives\[].name** `string` Name is the primitive name (tool name, resource URI, or prompt name). **accessRights.\{key}.mcp\_primitives\[].type** `string` Type is the MCP primitive type: "tool", "resource", or "prompt". **Allowed values:** `tool`, `resource`, `prompt`. **accessRights.\{key}.namespace** `string` Namespace of the ApiDefinition resource to target. Optional: a controller that supports it (TykSession) defaults it to the referring resource's own namespace, which a required field would make unreachable. **accessRights.\{key}.restricted\_types\[]** `object` Field access of GraphQL APIs can be restricted by setting up an allowed types list in a policy or directly on a key. **accessRights.\{key}.restricted\_types\[].fields\[]** `string` *required* **accessRights.\{key}.restricted\_types\[].name** `string` *required* **accessRights.\{key}.versions\[]** `string` ### basicAuth **basicAuth** `object` BasicAuth holds basic-auth configuration; required when type is basicAuth and forbidden otherwise. **basicAuth.username** `string` *required* Username is the basic-auth username. It is also the Tyk key ID. ### contextRef **contextRef** `object` Context specifies namespace/name of the OperatorContext object used for reconciling this TykSession. It defaults to the TykSession's own namespace; an OperatorContext in another namespace may only be referenced when it opts in with the label tyk.tyk.io/allow-cross-namespace: "true". The reference is immutable; create a new key to target another backend context. **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### credentialSecretRef **credentialSecretRef** `object` CredentialSecretRef references a Secret holding the user-supplied credential value (the key seed, or the basic-auth password). Must be in the same namespace as the TykSession. **credentialSecretRef.keyName** `string` *required* KeyName is the key of secret in which Tyk OAS doc is stored **credentialSecretRef.name** `string` *required* Name is the name of the secret **credentialSecretRef.namespace** `string` Namespace is the namespace of secret. If Namespace is not provided, we assume that the secret is in the same namespace as TykOasApiDefinition resource. ### hmac **hmac** `object` HMAC enables HMAC request signing on the key. **hmac.enabled** `boolean` Enabled turns on HMAC signing for this key. ### metaData **metaData** `object` MetaData is arbitrary key/value metadata stored on the key. **metaData.\{key}** `string` ### policies **policies\[]** `object` Policies are references to SecurityPolicy resources applied to this key. They must live in the same namespace as the TykSession. **policies\[].name** `string` *required* k8s resource name **policies\[].namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### writeToSecretRef **writeToSecretRef** `object` WriteToSecretRef names the operator-owned Secret the resulting credential is written to. Must be in the same namespace as the TykSession. **writeToSecretRef.name** `string` *required* k8s resource name **writeToSecretRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## TykUserGroup TykUserGroupSpec defines the desired state of TykUserGroup. A TykUserGroup is a declarative, org-scoped Dashboard user group: a shared RBAC permission set (user\_permissions) that Dashboard users are grouped under, and that TIB profiles / API ownership reference by id. It is Pro/Dashboard-only (the Gateway has no /usergroups API). It carries NO secret material — its whole payload is a name, description, active flag and an RBAC permission map. ### Top-Level Fields **active** `boolean` (default: True) Active enables the group. Defaults to true. **description** `string` Description is free text stored on the group. The operator also stamps a UID-bound, random-token ownership marker here; the user text is preserved. **groupID** `string` GroupID optionally adopts/imports a pre-existing group by its 24-hex Mongo id (requires the tyk.tyk.io/adopt annotation). When empty the operator derives a deterministic id from the CR identity (design D1). **name** `string` GroupName is the human-readable group name stored on the group. Defaults to the CR name when empty. **passwordMaxDays** `integer` PasswordMaxDays is the per-group password expiry in days (0 = none). ### userPermissions **userPermissions** `object` *required* UserPermissions is the RBAC grant map (maps to user\_permissions). Keys are Tyk ObjectGroups (apis, keys, policies, certs, hooks, analytics, users, user\_groups, oauth, portal, system, ...); values are read|write|admin|deny. The keys "IsAdmin" and "ResetPassword" are rejected (the Dashboard 403s them). **userPermissions.\{key}** `string` ### contextRef **contextRef** `object` Context specifies namespace/name of the OperatorContext used for reconciling this group. It defaults to the group's own namespace; an OperatorContext in another namespace may only be referenced when it opts in with the label tyk.tyk.io/allow-cross-namespace: "true". The reference is immutable; create a new group to target another backend context. **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ## TykWebhook TykWebhookSpec defines the desired state of TykWebhook. A TykWebhook is a declarative, reusable, org-scoped Dashboard webhook object (the object stored under /api/hooks that an API's event handler fires by id). It is fully typed: every field is a first-class, validated CRD field. Header values are the single secret vector and may reference a same-namespace Secret with the \$\{secretName:key} placeholder syntax (resolved in memory at reconcile time and never written back to the CR, status, events or logs). ### Top-Level Fields **method** `string` *required* Method is the HTTP method fired at the target. Required. **Allowed values:** `GET`, `POST`, `PUT`, `PATCH`, `DELETE`. **targetURL** `string` *required* TargetURL is the destination the webhook fires at (maps to target\_path). Required, and must be an absolute URL. **eventTimeout** `integer` EventTimeout is the per-event cool-down in seconds (maps to event\_timeout). **name** `string` WebhookName is the human-readable Name stored on the webhook. Defaults to the CR name when empty. **templatePath** `string` TemplatePath optionally names a request-body template file that MUST already exist on the Dashboard/gateway host; the operator only references it, it does not manage the file's content. ### contextRef **contextRef** `object` Context specifies namespace/name of the OperatorContext used for reconciling this webhook. It defaults to the webhook's own namespace; an OperatorContext in another namespace may only be referenced when it opts in with the label tyk.tyk.io/allow-cross-namespace: "true". The reference is immutable; create a new webhook to target another backend context. **contextRef.name** `string` *required* k8s resource name **contextRef.namespace** `string` The k8s namespace of the resource being targeted. When omitted this will be set to the namespace of the object that is being reconciled. ### headers **headers** `object` Headers are sent with the webhook (maps to header\_map). Values may embed \$\{secretName:key} to pull a value from a same-namespace Secret at reconcile time; the resolved value is never stored back to the CR, status or logs. **headers.\{key}** `string`