[System]
You are a helpful assistant that answers strictly in JSON. Here's the JSON schema you must adhere to:
<schema>
{"$schema":"http://json-schema.org/draft-07/schema#","$id":"https://json.schemastore.org/airlock-microgateway-3.2.json","additionalProperties":false,"definitions":{"DefaultActionDto":{"title":"dto action","type":"object","properties":{"enabled":{"type":["boolean","null"],"description":"Enable this default header action"},"name":{"type":["string","null"],"description":"Name of the default header action"}},"additionalProperties":false},"ExpertSettingsDto-nullable":{"type":["object","null"],"properties":{"apache":{"type":["string","null"],"description":"Expert settings for the Apache httpd."},"security_gate":{"type":["string","null"],"description":"Expert settings for the Security Gate."}},"additionalProperties":false},"PatternDto-nullable":{"type":["object","null"],"properties":{"ignore_case":{"type":"boolean","description":"Whether to ignore case.","default":"true"},"inverted":{"type":"boolean","description":"Whether to invert the match.","default":"false"},"pattern":{"type":"string","description":"A regex pattern used to match, cannot be empty. If you need a pattern that matches every string use \".*\""}},"required":["pattern"],"additionalProperties":false},"PatternWithRewriteDto-nullable":{"type":["object","null"],"properties":{"regex":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"The regular expression, which matches the parts which should be rewritten."}]},"substitution":{"type":["string","null"],"description":"The rewrite expression."}},"additionalProperties":false},"PatternWithoutInvertDto":{"title":"pattern","type":"object","properties":{"ignore_case":{"type":"boolean","description":"Whether to ignore case.","default":"true"},"pattern":{"type":"string","description":"A regex pattern used to match, cannot be empty. If you need a pattern that matches every string use \".*\""}},"required":["pattern"],"additionalProperties":false},"PatternWithoutInvertDto-nullable":{"anyOf":[{"type":"null"},{"$ref":"#/definitions/PatternWithoutInvertDto"}]},"RemoveHeaderActionDto-nullable":{"type":["object","null"],"properties":{"name":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A pattern for the header name."}]},"value":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A pattern for the header value."}]}},"additionalProperties":false},"RewriteHeaderValueDto-nullable":{"type":["object","null"],"properties":{"name":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A pattern for the header name."}]},"replace":{"type":["string","null"],"description":"A string to rewrite the header value with. Can make back-references to the header value pattern."},"value":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A pattern for the header value."}]}},"additionalProperties":false},"SimpleHeaderActionDto-nullable":{"type":["object","null"],"properties":{"name":{"type":["string","null"],"description":"The name of the header to add."},"value":{"type":["string","null"],"description":"The value of the header to add."}},"additionalProperties":false},"SimplePatternDto-nullable":{"type":["object","null"],"properties":{"pattern":{"type":["string","null"],"description":"The actual pattern."}},"additionalProperties":false}},"properties":{"apps":{"type":"array","items":{"title":"application","type":"object","properties":{"mappings":{"type":"array","items":{"title":"mapping","type":"object","properties":{"access_token":{"type":["object","null"],"properties":{"audittoken":{"type":["boolean","null"],"description":"If the 'sub' claim should be extracted from the JWT and be used as audit token of the current session","default":"false"},"claims":{"description":"All specified claims are checked and must match the claim's value of the decoded token. If a claim is an array, at least one entry must match the specified regex.","type":"array","items":{"title":"claim","type":"object","properties":{"claim":{"type":["string","null"],"description":"The name of the claim you want to restrict."},"regex":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"The regular expression that must match the value of the specified claim name."}]}},"additionalProperties":false}},"expiry_checked":{"type":["boolean","null"],"description":"If the JWT standard claims expiry (exp) and not before (nbf) will be checked and must be valid.","default":"false"},"extraction":{"type":["object","null"],"properties":{"cookie":{"type":["string","null"],"description":"From which cookie the token should be extracted."},"header":{"allOf":[{"$ref":"#/definitions/PatternWithRewriteDto-nullable"},{"description":"How the token should be extracted from the request headers."}]},"mode":{"anyOf":[{"type":"null"},{"type":"string","enum":["header","parameter","cookie"]}],"description":"From which part of the request the token should be extracted. Possible values are 'header', 'parameter', 'cookie'.","default":"header"},"parameter":{"type":["string","null"],"description":"From which query parameter the token should be extracted."}},"additionalProperties":false,"description":"How the token should be extracted."},"jwks_providers":{"description":"List of JWKS service providers referenced by their name. Can be local or remote providers.","type":"array","items":{"type":"string"}},"mandatory":{"type":["boolean","null"],"description":"If disabled, requests without a token are accepted. However, if a token is present,it is extracted and validated and the configured restrictions and role extractions are applied. ","default":"false"},"roles":{"description":"Specifies which roles should be extracted from the claims.","type":"array","items":{"title":"role","type":"object","properties":{"claim":{"type":["string","null"],"description":"Name of the claim you want to extract a role from."},"extraction":{"allOf":[{"$ref":"#/definitions/PatternWithRewriteDto-nullable"},{"description":"The regular expression to match the role extraction and the rewrite expression of the role."}]},"token_lifetime":{"type":["boolean","null"],"description":"If enabled, the expiry claim (exp) of the JWT will be used as the role lifetime.","default":"false"}},"additionalProperties":false}},"signature_mandatory":{"type":["boolean","null"],"description":"Enforce a signed JWT","default":"true"},"skew":{"type":["integer","null"],"description":"The allowed skew when checking expiry / not before in seconds.","default":"10"},"tech_client_id_claim":{"type":["string","null"],"description":"The claim to extract the technical client id from."}},"additionalProperties":false},"allow_rules":{"type":"array","items":{"title":"allowed roles","type":"object","properties":{"content_type":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A pattern to match the content type for this allow rule."}]},"enabled":{"type":"boolean","description":"Enable the allow rule.","default":"true"},"log_only":{"type":"boolean","description":"Whether to log requests not matching this allow rule instead of blocking them.","default":"false"},"method":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A pattern to match the http method for this allow rule."}]},"name":{"type":"string","description":"Unique name for the allow rule. If omitted, a unique name will be generated. To enable/disable the default allow rule or one from a mapping_template_file, use the same name.","default":"Allow all"},"path":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A pattern to match the path."}]}},"additionalProperties":false}},"api_security":{"type":["object","null"],"properties":{"json_content_type":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"JSON objects are parsed only if their content-type matches the specified pattern.","default":"json"}]},"openapi":{"type":["object","null"],"properties":{"log_only":{"type":["boolean","null"],"description":"If enabled, potential attack requests are only logged but not blocked.","default":"false"},"path_matching":{"anyOf":[{"type":"null"},{"type":"string","enum":["client_view","backend_view"]}],"description":"The Microgateway mapping can be configured to rewrite the incoming URL to a different back-end URL (asymmetric mappings). Due to this rewriting, the incoming URL path (client_view) will be different from the back-end URL path (backend_view).","default":"client_view"},"response_validation":{"type":["boolean","null"],"description":"Check responses against API specification.","default":"false"},"spec":{"type":["string","null"],"description":"The OpenAPI specification."},"spec_file":{"type":["string","null"],"description":"The OpenAPI file path.","default":"/config/openapi.json"}},"additionalProperties":false,"description":"The specification to validate against."},"treat_json_objects_as_parameters":{"type":["boolean","null"],"description":"If enabled, Microgateway parses JSON objects in requests and filters JSON attributes with allow rules and deny rules.","default":"true"},"treat_path_segments_as_parameters":{"type":["boolean","null"],"description":"If enabled, each path segment is interpreted as a separate parameter value and the deny rules for parameter values are applied to it.","default":"true"}},"additionalProperties":false},"auth":{"type":["object","null"],"properties":{"access":{"description":"A list of access restrictions can be created. Each request matching the combination of HTTP method and path of a access restriction must have at least one of the specified roles to access the service. All matching restrictions must be satisfied to gain access.","type":"array","items":{"title":"access restriction","type":"object","properties":{"method":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"Can contain regular expressions that are applied when the HTTP method of a request matches one of the expressions. Use an empty pattern if all HTTP methods should match."}]},"path":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"Can contain regular expressions that are applied when the requested path of the query matches the expressions. Use an empty pattern if all paths should match."}]},"roles":{"description":"Can contain a list of roles for this service. Only sessions that have at least one of these roles will be able to access the service.","type":"array","items":{"type":"string"}}},"additionalProperties":false}},"client_certificate":{"type":["object","null"],"properties":{"verification":{"type":"string","enum":["inherit","optional","required"],"description":"The client certificate verification mode to use on this mapping. This can be used to override the setting from the virtual host with a stronger verification level (e.g. off -> optional or optional -> required). Possible values are 'inherit', 'optional' or 'required'.","default":"inherit"}},"additionalProperties":false},"denied_access_url":{"type":["string","null"],"description":"Defines the location of the authentication service. In case the required role for the mapping is missing on the current session, Airlock Gateway will redirect the client to this location. If this value is missing (default), the Global Denied Access URL will be used.","default":"/auth/check-login"},"flow":{"anyOf":[{"type":"null"},{"type":"string","enum":["redirect","deny_access","one_shot","one_shot_with_body","ntlm"]}],"description":"The authentication flow, allowed values are: redirect, deny_access, one_shot, one_shot_with_body, ntlm","default":"redirect"},"logout_propagation_path":{"type":["string","null"],"description":"In order to allow clean session termination on back-end systems when an Airlock Gateway session terminates, the administrator can configure one logout path per mapping."}},"additionalProperties":false},"backend":{"type":["object","null"],"properties":{"expert_settings":{"type":["object","null"],"properties":{"security_gate":{"type":["string","null"],"description":"Expert settings for the Security Gate."}},"additionalProperties":false},"hosts":{"type":"array","items":{"title":"host","type":"object","properties":{"name":{"type":"string","description":"The hostname of the back-end host. Only characters a-Z, numbers, and the special characters '.', ':',  '-' and '_' are allowed.","default":"backend","pattern":"^[A-Za-z0-9.\\-_:]+$"},"port":{"type":"integer","description":"Configuring a back-end port.","default":"8080","minimum":1,"maximum":65535},"protocol":{"type":"string","enum":["https","http"],"description":"Allowed values are: http, https","default":"http"}},"additionalProperties":false}},"name":{"type":"string","description":"The unique name of the back-end. Only characters a-Z, numbers, and the special characters '.', ':',  '-' and '_' are allowed.","default":"backendGroup","pattern":"^[A-Za-z0-9.\\-_:]+$"}},"additionalProperties":false},"backend_path":{"type":["string","null"],"description":"The back-end path specifies the internal back-end path, i.e. the path of the request sent to the application server.","default":"/"},"compress_response_traffic":{"type":["boolean","null"],"description":"Specifies whether Airlock Microgateway should compress the output on-the-fly for the client browser if supported and requested by the browser.","default":"false"},"control_api":{"type":["boolean","null"],"description":"Specifies whether the connected back-end service is allowed to use the Airlock Microgateway Control API via the control cookie mechanism. The Control API is normally used by authentication applications to communicate with the Microgateway.","default":"false"},"cookies":{"type":["object","null"],"properties":{"encrypted":{"allOf":[{"$ref":"#/definitions/SimplePatternDto-nullable"},{"description":"Cookies that should be cryptographically encrypted before being sent to the client."}]},"passthrough":{"allOf":[{"$ref":"#/definitions/SimplePatternDto-nullable"},{"description":"Cookies that should be passed in plain format to the client."}]}},"additionalProperties":false},"csrf_token":{"type":["object","null"],"properties":{"enabled":{"type":["boolean","null"],"description":"Whether to enable automatic CSRF token injection and validation on this mapping.","default":"false"},"exceptions":{"description":"All incoming URLs that match one of these patterns are accepted by Airlock Microgateway without a valid CSRF token.","type":["array","null"],"items":{"title":"exception","type":"object","properties":{"path":{"$ref":"#/definitions/PatternWithoutInvertDto-nullable"}},"additionalProperties":false}},"invalid_token_redirect_location":{"type":["string","null"],"description":"Specifies the location (e.g. /index.html) to which the client is redirected if a missing or invalid CSRF token is detected.","default":"/%ENTRYPATH%"}},"additionalProperties":false},"deny_rule_groups":{"type":"array","items":{"title":"denied rule groups","type":"object","properties":{"enabled":{"type":["boolean","null"],"description":"Enable deny rule group","default":"true"},"exceptions":{"type":"array","items":{"title":"exception","type":"object","properties":{"content_type":{"$ref":"#/definitions/PatternDto-nullable"},"header_name":{"$ref":"#/definitions/PatternDto-nullable"},"header_value":{"$ref":"#/definitions/PatternDto-nullable"},"method":{"$ref":"#/definitions/PatternDto-nullable"},"parameter_name":{"$ref":"#/definitions/PatternDto-nullable"},"parameter_value":{"$ref":"#/definitions/PatternDto-nullable"},"path":{"$ref":"#/definitions/PatternDto-nullable"}},"additionalProperties":false}},"level":{"anyOf":[{"type":"null"},{"type":"string","enum":["basic","standard","strict"]}],"description":"Allowed values are: basic, standard, strict.","default":"standard"},"log_only":{"type":["boolean","null"],"description":"If enabled, offending requests are not blocked but only logged","default":"false"},"rule_group_keys":{"description":"If deny rule group key is defined, the settings will only affect the specific deny rule group.","type":"array","items":{"type":"string"}}},"additionalProperties":false}},"entry_path":{"type":["object","null"],"properties":{"enforce_trailing_slashes":{"type":["boolean","null"],"description":"Whether a trailing slash is mandatory at the end of the entry path or not.","default":"false"},"ignore_case":{"type":["boolean","null"],"description":"Whether to ignore case.","default":"false"},"type":{"anyOf":[{"type":"null"},{"type":"string","enum":["directory","regex"]}],"description":"Allowed values are: directory, regex.","default":"directory"},"value":{"type":["string","null"],"description":"This specifies the external URL path.","default":"/"}},"additionalProperties":false,"description":"The entry path specifies the external URL path the mapping should be available under."},"env_cookies":{"type":["boolean","null"],"description":"Specifies whether Airlock environment cookies containing useful request information are sent to the connected back-end.","default":"false"},"expert_settings":{"$ref":"#/definitions/ExpertSettingsDto-nullable"},"limits":{"type":["object","null"],"properties":{"http_limits":{"type":["object","null"],"properties":{"max_parameter_name_length":{"type":["integer","null"],"description":"Defines the maximum length of a parameter name in bytes.","default":"128"},"max_parameter_value_length":{"type":["integer","null"],"description":"Defines the maximum length for a parameter value in bytes.","default":"1024"},"max_parameters":{"type":["integer","null"],"description":"Defines the maximum number of parameters inside the request.","default":"128"},"parameter_length_exception":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A regular expression which specifies any parameters which should not be checked against these length checks."}]}},"additionalProperties":false,"description":"The limits for HTTP parameters."},"json_limits":{"type":["object","null"],"properties":{"max_array_items":{"type":["integer","null"],"description":"Defines the maximum number of items in a single JSON array (non-recursive).","default":"500"},"max_key_length":{"type":["integer","null"],"description":"Defines the maximum length for a JSON key, also known as 'JSON property' or 'JSON object member' in bytes.","default":"256"},"max_keys":{"type":["integer","null"],"description":"Defines the maximum number of keys of a single JSON object (non-recursive).","default":"250"},"max_length_exception":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"Defines a regular expression to exclude JSON keys and the corresponding values from the length checks. The exceptions must be specified in the '#json' format for a JSON key."}]},"max_nesting_depth":{"type":["integer","null"],"description":"Defines the maximum depth of nesting for JSON objects and JSON arrays.","default":"100"},"max_total_entries":{"type":["integer","null"],"description":"Defines the maximum number of keys and array items in the whole JSON document (recursive).","default":"150000"},"max_value_length":{"type":["integer","null"],"description":"Defines the maximum length for a JSON value (string or numbers) in bytes.","default":"8192"}},"additionalProperties":false,"description":"The limits for JSON structures."},"max_path_length":{"type":["integer","null"],"description":"Defines the maximum path length for requests to the current mapping in bytes.","default":"1024"},"max_request_body_size":{"type":["integer","null"],"description":"The maximum allowed total size of the request body in bytes. It specifies the number of bytes from 0 (meaning unlimited) to 2147483647 (2GB) that are allowed in the request body. To restrict the size of file uploads, set this limit to the maximum combined size of all files uploaded at once.","default":"104857600"}},"additionalProperties":false},"mapping_template_file":{"type":["string","null"],"description":"The Airlock Gateway mapping template file path.","default":"/config/mapping.xml"},"name":{"type":["string","null"],"description":"The unique name of the mapping.","default":"root"},"operational_mode":{"anyOf":[{"type":"null"},{"type":"string","enum":["production","integration"]}],"description":"Allowed values are: production, integration.","default":"production"},"parameter_pollution":{"type":["object","null"],"properties":{"mixed_type":{"type":["object","null"],"properties":{"block_duplicates":{"type":["boolean","null"],"description":"If enabled, requests are blocked if they contain the same parameter names with different parameter types (e.g. \"id\" is present as a POST parameter and as a query parameter simultaneously).","default":"true"},"log_only":{"type":["boolean","null"],"description":"If enabled, offending requests are not blocked but only logged.","default":"false"},"parameter_name_exception":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"Exception pattern to exclude parameters from the parameter pollution detection."}]}},"additionalProperties":false},"same_type":{"type":["object","null"],"properties":{"join_duplicates":{"type":["boolean","null"],"description":"If enabled, all the different values of a repeated parameter are joined by comma (in order of appearance). The aggregate value is then checked against deny rules (instead of the individual values).","default":"true"}},"additionalProperties":false}},"additionalProperties":false},"priority":{"type":["integer","null"],"description":"Specifies the priority of this mapping (highest: -999, lowest: 999) when a request matches the entry path of multiple mappings.\nAll mappings with entry_path.type regex must have a unique priority.","default":"0","minimum":-999,"maximum":999},"request":{"type":["object","null"],"properties":{"custom_actions":{"description":"A list of request custom actions executed in order of appearance. Only one action type (e.g. add_header or header_redirect) can be specified in each entry. Create multiple list positions if needed.","type":["array","null"],"items":{"title":"custom action","type":"object","properties":{"add_header":{"allOf":[{"$ref":"#/definitions/SimpleHeaderActionDto-nullable"},{"description":"An action to add a header to all requests."}]},"add_missing_header":{"allOf":[{"$ref":"#/definitions/SimpleHeaderActionDto-nullable"},{"description":"An action to add a header to all requests if it is not already present."}]},"add_or_replace_header":{"allOf":[{"$ref":"#/definitions/SimpleHeaderActionDto-nullable"},{"description":"An action to add or replace an existing header to all requests."}]},"geolocation_redirect":{"type":["object","null"],"properties":{"continent_codes":{"description":"A list of alpha-2 continent codes to redirect clients from. See here: https://en.wikipedia.org/wiki/List_of_sovereign_states_and_dependent_territories_by_continent_(data_file)","default":"[]","type":["array","null"],"items":{"type":"string","default":"[]"}},"country_codes":{"description":"A list of country codes to redirect clients from. See here for alpha-2 codes to use: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2","default":"[]","type":["array","null"],"items":{"type":"string","default":"[]"}},"status_code":{"type":["integer","null"],"description":"The http status code to use on redirect","default":"303"},"target_url":{"type":["string","null"],"description":"The url to redirect to."}},"additionalProperties":false,"description":"An action to redirect to a URL based on the geographic location of the request source IP."},"header_redirect":{"type":["object","null"],"properties":{"name":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A pattern for the header name."}]},"status_code":{"type":["integer","null"],"description":"The http status code to use on redirect","default":"303"},"target_url":{"type":["string","null"],"description":"The url to redirect to."},"value":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A pattern for the header value."}]}},"additionalProperties":false,"description":"An action to redirect to a URL based on a header name or value either matching the given name or value pattern on requests."},"name":{"type":"string","description":"A unique name for this action; if not specified, a unique name will be generated."},"remove_header":{"allOf":[{"$ref":"#/definitions/RemoveHeaderActionDto-nullable"},{"description":"An action to remove a header either matching given name or value pattern on requests."}]},"rewrite_header_value":{"allOf":[{"$ref":"#/definitions/RewriteHeaderValueDto-nullable"},{"description":"An action to rewrite a header value either matching given name or value pattern on requests."}]}},"additionalProperties":false}},"default_actions":{"type":["array","null"],"items":{"$ref":"#/definitions/DefaultActionDto"}}},"additionalProperties":false},"response":{"type":["object","null"],"properties":{"custom_actions":{"description":"A list of request custom actions executed in order of appearance. Only one action type (e.g. add_header or header_redirect) can be specified in each entry. Create multiple list positions if needed.","type":["array","null"],"items":{"title":"custom action","type":"object","properties":{"add_header":{"allOf":[{"$ref":"#/definitions/SimpleHeaderActionDto-nullable"},{"description":"An action to add a header to all responses."}]},"add_missing_header":{"allOf":[{"$ref":"#/definitions/SimpleHeaderActionDto-nullable"},{"description":"An action to add a header to all responses if it is not already present."}]},"add_or_replace_header":{"allOf":[{"$ref":"#/definitions/SimpleHeaderActionDto-nullable"},{"description":"An action to add or replace an existing header on all responses."}]},"name":{"type":"string","description":"A unique name for this action; if not specified, a unique name will be generated."},"remove_header":{"allOf":[{"$ref":"#/definitions/RemoveHeaderActionDto-nullable"},{"description":"An action to remove a header either matching given name or value pattern on responses."}]},"rewrite_cookie":{"type":["object","null"],"properties":{"cookie":{"allOf":[{"$ref":"#/definitions/PatternDto-nullable"},{"description":"A pattern to match the name of the cookie to rewrite. If this is set the name of the cookie must match this pattern for the rewrite to happen."}]},"domain":{"allOf":[{"$ref":"#/definitions/PatternWithoutInvertDto-nullable"},{"description":"A pattern to match the domain, or part of the domain of a cookie to rewrite it."}]},"domain_replace":{"type":["string","null"],"description":"What to replace the domain with; Can make back references to the pattern used to match."},"http_only_mode":{"type":"string","enum":["auto","keep","remove","add"],"description":"Whether to `add`, `keep` or `remove` the `HttpOnly` (see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#HttpOnly) flag on cookies. AUTO will set the flag for encrypted cookies and KEEP it for others.","default":"auto"},"path":{"allOf":[{"$ref":"#/definitions/PatternWithoutInvertDto-nullable"},{"description":"A pattern to match the path of a response to rewrite."}]},"path_replace":{"type":["string","null"],"description":"What to replace the path with; Can make back references to the pattern used to match."},"secure_mode":{"type":"string","enum":["auto","keep","remove","add"],"description":"Whether to `add`, `keep` or `remove` the `Secure` (see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Secure) flag on cookies. AUTO will set the flag on all connections that use HTTPS and remove it on others.","default":"auto"}},"additionalProperties":false,"description":"An action to rewrite a cookie based on patterns for cookie name, domain etc."},"rewrite_header_value":{"allOf":[{"$ref":"#/definitions/RewriteHeaderValueDto-nullable"},{"description":"An action to rewrite a header value either matching given name or value pattern on responses."}]},"rewrite_raw_cookie":{"type":["object","null"],"properties":{"replace":{"type":["string","null"],"description":"A string to rewrite value pattern matches in the cookie value. Can make back references to the pattern used for matching."},"value":{"allOf":[{"$ref":"#/definitions/PatternWithoutInvertDto-nullable"},{"description":"A pattern for the cookie value to apply for matching."}]}},"additionalProperties":false,"description":"An action to rewrite the raw value of a cookie matching the given pattern."}},"additionalProperties":false}},"default_actions":{"type":["array","null"],"items":{"$ref":"#/definitions/DefaultActionDto"}},"error_page_replacements":{"description":"Replacement rules for error responses returned by backend systems.","type":["array","null"],"items":{"title":"error page replacement","type":"object","properties":{"page":{"type":["string","null"],"description":"Error page file name that will be delivered to the client. (eg. 400.html)"},"status_code":{"allOf":[{"$ref":"#/definitions/SimplePatternDto-nullable"},{"description":"The http response with the matching status code that should be replaced."}]}},"additionalProperties":false}},"rewrites":{"type":["object","null"],"properties":{"any":{"description":"Rewrite the body of HTTP response.","type":"array","items":{"title":"rewrite","type":"object","properties":{"content":{"allOf":[{"$ref":"#/definitions/PatternWithoutInvertDto-nullable"},{"description":"This regular expression pattern defines the content to rewrite."}]},"content_type":{"type":"string","description":"A response from the back-end server is rewritten only if the response header \u00abContent-Type\u00bb matches this regular expression.","default":"^(?:text|application)/(?:html|xhtml)"},"to":{"type":["string","null"],"description":"This is the target string which will replace the string matched by Content Pattern"}},"additionalProperties":false}},"html":{"description":"Rewriting HTML content may be necessary to modify URLs in the HTML content if the application creates absolute or incorrect links because it is not reverse proxy compatible","type":"array","items":{"title":"html","type":"object","properties":{"options":{"description":"This list defines the content to rewrite. Possible values are 'url', event', 'embedded'.","default":"[ url ]","type":"array","items":{"type":"string","enum":["url","event","embedded"],"default":"[ url ]"}},"to":{"type":["string","null"],"description":"This is the target string which will replace the string matched by URL Pattern"},"url":{"allOf":[{"$ref":"#/definitions/PatternWithoutInvertDto-nullable"},{"description":"The URL pattern."}]}},"additionalProperties":false}},"json":{"description":"Rewrite the json body of http responses.","type":"array","items":{"title":"json","type":"object","properties":{"content":{"allOf":[{"$ref":"#/definitions/PatternWithoutInvertDto-nullable"},{"description":"This regular expression pattern defines the content to rewrite."}]},"path":{"type":"string","description":"The json path of the the property to rewrite."},"replace":{"type":"string","description":"This is the target content to replace the matched part with."}},"additionalProperties":false}},"location_header":{"description":"Rewrite option to modify the HTTP redirect location header sent from the back-end server before it is sent to the client.","type":"array","items":{"title":"location header","type":"object","properties":{"to":{"type":["string","null"],"description":"This is the target string which will replace the string matched by URL Pattern"},"url":{"allOf":[{"$ref":"#/definitions/PatternWithoutInvertDto-nullable"},{"description":"The redirect URL pattern."}]}},"additionalProperties":false}}},"additionalProperties":false}},"additionalProperties":false},"session_handling":{"anyOf":[{"type":"null"},{"type":"string","enum":["enforce_session","optional_session","optional_session_no_refresh","ignore_session"]}],"description":"Allowed values are: enforce_session, optional_session, optional_session_no_refresh, ignore_session","default":"ignore_session"},"threat_handling":{"anyOf":[{"type":"null"},{"type":"string","enum":["terminate_session","block","notify"]}],"description":"Allowed values are: block, terminate_session, notify.","default":"block"},"timeouts":{"type":["object","null"],"properties":{"backend_http_response":{"type":["integer","null"],"description":"Defines the time in seconds Airlock Microgateway will wait for the back-end HTTP response. In case the request runs into the timeout, Airlock Microgateway will deliver an error page with the corresponding HTTP 503 status code.","default":"120"},"idle_session":{"type":["integer","null"],"description":"Defines the minimum session idle time in seconds for this mapping. The value will be ignored if minimum session idle timeout is smaller or equal to the global session idle timeout setting.","default":"0"}},"additionalProperties":false}},"additionalProperties":false}},"virtual_host":{"type":["object","null"],"properties":{"aliases":{"description":"Additional hostnames which refer to this virtual host.","type":"array","items":{"type":"string"}},"auth":{"type":["object","null"],"properties":{"client_certificate":{"type":["object","null"],"properties":{"ca_selection":{"type":["string","null"],"description":"The concatenated certificates of the CAs which are sent to the client during the SSL handshake, in PEM format."},"ca_selection_file":{"type":["string","null"],"description":"The file containing the selection CA certificates.","default":"/secret/auth/client_certificate/selection.crt"},"ca_validation":{"type":["string","null"],"description":"The concatenated certificates of the CAs which are used as trust anchor during chain validation, in PEM format."},"ca_validation_file":{"type":["string","null"],"description":"The file containing the validation CA certificates.","default":"/secret/auth/client_certificate/validation.crt"},"crl":{"type":["string","null"],"description":"PEM representation of certificate revocation lists. If a client certificate is on such a list it will not be accepted. Although Airlock provides this functionality, it is recommended to check certificates against CRLs and other types of blacklists within the authentication service and not in Airlock."},"crl_file":{"type":["string","null"],"description":"The file containing the crl.","default":"/secret/auth/client_certificate/client.crl"},"verification":{"type":"string","enum":["off","optional","required"],"description":"Defines the default verification mode for client certificates on this virtual host. Possible values are 'off', 'optional' or 'required'.","default":"off"},"verification_depth":{"type":"integer","description":"Maximum number of intermediate certificate issuers.","default":"1"}},"additionalProperties":false}},"additionalProperties":false},"certificate":{"type":["object","null"],"properties":{"ca_chain":{"type":["string","null"],"description":"List of certificates of the CA chain for the certificate."},"ca_chain_file":{"type":["string","null"],"description":"The CA chain file path.","default":"/secret/tls/frontend-server-ca.crt"},"certificate":{"type":["string","null"],"description":"The certificate in PEM format."},"certificate_file":{"type":["string","null"],"description":"The certificate file path.","default":"/secret/tls/frontend-server.crt"},"privatekey":{"type":["string","null"],"description":"The private key for the certificate in PEM format."},"privatekey_file":{"type":["string","null"],"description":"The private key file path","default":"/secret/tls/frontend-server.key"}},"additionalProperties":false},"encoded_slashes":{"type":"boolean","description":"Specifies whether encoded slashes (%2F) are allowed in URL path. Attention: combinations of client certificates per mapping and enabled encoded slashes in the same virtual host might result in configurations where client certificate evaluation might be evaded.","default":"false"},"expert_settings":{"$ref":"#/definitions/ExpertSettingsDto-nullable"},"hostname":{"type":"string","description":"The hostname of the virtual host.","default":"microgateway"},"http2_enabled":{"type":"boolean","description":"Specifies whether HTTP/2 connections are enabled for this host.","default":"true"},"http_enabled":{"type":"boolean","description":"Specifies whether HTTP connections are enabled for this host.","default":"true"},"http_port":{"type":"integer","description":"Specifies the port on which this host listens for HTTP connections.","default":"8080","minimum":1,"maximum":65535},"https_enabled":{"type":"boolean","description":"Specifies whether HTTPS connections are enabled for this host.","default":"true"},"https_port":{"type":"integer","description":"Specifies the port on which this host listens for HTTPS connections.","default":"8443","minimum":1,"maximum":65535},"name":{"type":"string","description":"The logical name of the virtual host.","default":"microgateway"},"redirects":{"type":["array","null"],"items":{"title":"redirect","type":"object","properties":{"dest":{"type":"string","description":"The destination can be relative to the current virtual host or an absolute URL including protocol and host. Relative redirect paths are extended with the incoming scheme and host header.","minLength":1,"pattern":"^(http://|https://|ftp://|/)\\S*?$"},"path":{"allOf":[{"$ref":"#/definitions/PatternWithoutInvertDto"},{"description":"The absolute path starting with '/' as a regular expression from which to redirect."}]},"status_code":{"type":"integer","description":"The returned status code. Must be one of: [301, 302, 303, 307, 308]","default":"303","minimum":301,"maximum":308}},"required":["dest","path"],"additionalProperties":false}},"session_cookie_domain":{"type":["string","null"],"description":"Specifies the domain for Airlock's session cookie if the cookie is created inside this virtual host."},"session_cookie_path":{"type":"string","description":"Specifies the cookie path for Airlock's session cookie if the cookie is created inside this virtual host.","default":"/"},"strict_fqdn":{"type":"boolean","description":"Specifies whether a virtual host should reply only to requests that match the hostname or any of its server alias names.","default":"false"}},"additionalProperties":false}},"additionalProperties":false}},"deny_rule_groups":{"description":"Custom deny rule groups that can be referenced in mappings on top of the built in Airlock deny rules.","type":"array","items":{"title":"denied rule groups","type":"object","properties":{"deny_rules":{"description":"Filter rule that blocks requests based on the evaluation of different request attributes.","type":"array","items":{"title":"denied rules","type":"object","properties":{"content_type":{"$ref":"#/definitions/PatternDto-nullable"},"header_name":{"$ref":"#/definitions/PatternDto-nullable"},"header_value":{"$ref":"#/definitions/PatternDto-nullable"},"method":{"$ref":"#/definitions/PatternDto-nullable"},"name":{"type":"string","description":"Unique name. In order to prevent overriding built-in deny rules, the name may not start with '(default)'.","pattern":"^(?![ \\t\\n]*\\(default(.*)\\))[\\s\\S]*"},"parameter_name":{"$ref":"#/definitions/PatternDto-nullable"},"parameter_value":{"$ref":"#/definitions/PatternDto-nullable"},"path":{"$ref":"#/definitions/PatternDto-nullable"},"rule_key":{"type":"string","description":"Unique short name. In order to prevent overriding built-in deny rules, the name may not start with '(default)'.","pattern":"^(?![ \\t\\n]*\\(default(.*)\\))[\\s\\S]*"}},"additionalProperties":false}},"name":{"type":"string","description":"Unique name. In order to prevent overriding built-in deny rule group, the name may not start with '(default)'.","pattern":"^(?![ \\t\\n]*\\(default(.*)\\))[\\s\\S]*"},"rule_group_key":{"type":"string","description":"Unique short name. In order to prevent overriding built-in deny rule group, the name may not start with '(default)'.","pattern":"^(?![ \\t\\n]*\\(default(.*)\\))[\\s\\S]*"}},"additionalProperties":false}},"expert_settings":{"$ref":"#/definitions/ExpertSettingsDto-nullable"},"jwks_providers":{"type":["object","null"],"properties":{"local":{"description":"JWKS providers that are configured statically.","default":"[]","type":"array","items":{"title":"provider","type":"object","properties":{"issuer":{"type":["string","null"],"description":"Name of JWKS issuer. Corresponds to the 'Issuer' field in JWT."},"jwks":{"type":["string","null"],"description":"JSON Object that represents the set of JWKS."},"jwks_file":{"type":["string","null"],"description":"JSON file with the definitions of JWKS."},"name":{"type":"string","description":"Name by which provider is referenced. Must be unique."}},"required":["name"],"additionalProperties":false,"default":"[]"}},"refresh_interval":{"type":"integer","description":"Refresh interval for fetching from remote JWKS providers in seconds.","default":"86400"},"remote":{"description":"Remote JWKS providers which are fetched according to the jwks_providers.refresh_interval.","default":"[]","type":"array","items":{"title":"provider","type":"object","properties":{"issuer":{"type":["string","null"],"description":"Name of JWKS issuer. This value is used to restrict the usage of the JWKS to JWTs with a matching issuer (claim 'iss')."},"name":{"type":"string","description":"Name by which provider is referenced. Must be unique."},"service_url":{"type":"string","description":"URL of JWKS service provider."},"tls":{"title":"tls","type":"object","properties":{"cipher_suite":{"type":"string","description":"The TLS cipher suite to use. For documentation visit www.openssl.org and search for 'ciphers'.","default":"DEFAULT"},"client":{"type":["object","null"],"properties":{"ca_chain":{"type":["string","null"],"description":"List of certificates of the CA chain for the certificate."},"ca_chain_file":{"type":["string","null"],"description":"The CA chain file path.","default":"/secret/auth/jwks/tls/client/client-ca.crt"},"certificate":{"type":["string","null"],"description":"The certificate in PEM format."},"certificate_file":{"type":["string","null"],"description":"The certificate file path.","default":"/secret/auth/jwks/tls/client/client.crt"},"privatekey":{"type":["string","null"],"description":"The private key for the certificate in PEM format."},"privatekey_file":{"type":["string","null"],"description":"The private key file path","default":"/secret/auth/jwks/tls/client/client.key"}},"additionalProperties":false},"force_new_session":{"type":"boolean","description":"Force new session for each request.","default":"false"},"protocol":{"type":"string","enum":["DEFAULT","TLSv1_0","TLSv1_1","TLSv1_2","TLSv1_3"],"description":"The TLS protocol to use. For the description of the default values see the Gateway documentation for 'Supported SSL/TLS versions'.","default":"DEFAULT"},"server":{"type":["object","null"],"properties":{"ca_validation":{"type":["string","null"],"description":"The concatenated certificates of the CAs which are used as trust anchor during chain validation, in PEM format."},"ca_validation_file":{"type":["string","null"],"description":"The file containing the validation CA certificates.","default":"/secret/auth/jwks/tls/server/server-validation.crt"},"host_name_verification":{"type":"boolean","description":"Verification which involves a server identity check to mitigate man in the middle attacks.","default":"false"}},"additionalProperties":false}},"additionalProperties":false}},"required":["name","service_url"],"additionalProperties":false,"default":"[]"}}},"additionalProperties":false,"description":"JWKS Providers which can be referenced in apps[].mappings[].access_token."},"license":{"type":["string","null"],"description":"The encoded license."},"license_file":{"type":["string","null"],"description":"The license file path.","default":"/secret/license"},"log":{"type":["object","null"],"properties":{"level":{"type":"string","enum":["info","trace"],"description":"Allowed values are: info, trace","default":"info"}},"additionalProperties":false},"metrics":{"title":"metrics","type":"object","properties":{"statsd":{"title":"statsd","type":"object","properties":{"enabled":{"type":"boolean","description":"Enable sending of statsd metrics. Default is 'true'","default":"true"}},"additionalProperties":false,"description":"Use this to enable sending metrics using the statsd protocol."}},"additionalProperties":false,"description":"Configuration for metrics sending."},"remote_ip":{"type":["object","null"],"properties":{"header":{"type":"string","description":"If set, Airlock Microgateway will treat the value of this header field as the useragent IP address.<br />Common values are 'X-Forwarded-For' or 'X-Client-IP'.<br /><strong>Warning</strong>: Make sure that internal_proxies is correctly configured for your setup."},"internal_proxies":{"description":"List of hostnames, IP addresses or IP address ranges (e.g. 10.0.0.0/8) to trust as presenting a valid Remote-IP header.","type":"array","items":{"type":"string"}}},"required":["header","internal_proxies"],"additionalProperties":false},"session":{"type":["object","null"],"properties":{"encryption_passphrase":{"type":["string","null"],"description":"Specifies the passphrase for the passphrase based encryption mechanism (PBE)."},"encryption_passphrase_file":{"type":["string","null"],"description":"The path of the passphrase file.","default":"/secret/passphrase"},"idle_timeout":{"type":"integer","description":"Specifies the amount of idle time in seconds, after which an Airlock Microgateway session is terminated. This timeout should be smaller than all other session timeouts of your back-end applications. Even if the timeout can be configured in seconds, per default the resolution of the idle session timeout check is 5 seconds only.","default":"600"},"lifetime":{"type":"integer","description":"Specifies the absolute lifetime of an Airlock Microgateway session in seconds. After this time a session will be terminated.","default":"28800"},"redis_hosts":{"description":"Name of the hosts running the Redis Server.","default":"[]","type":"array","items":{"type":"string","default":"[]"}},"store_mode":{"type":"string","enum":["server","cluster","disabled"],"description":"Defines the redis session store connection mode. By default, the Microgateway tries to determine the connection mode depending on the number of redis hosts configured:<br />- server mode if only one host is configured<br />- cluster mode if several hosts are configured<br /><br />Allowed values are: server, cluster and disabled."}},"additionalProperties":false}},"type":"object"}
</schema>

[User] Provide a JSON object that satisfies the schema "airlock-microgateway-3.2". Here are the required top‑level fields: none (all optional). Return only the valid JSON object.

dto action

Enable this default header action

Name of the default header action

Expert settings for the Apache httpd.

Expert settings for the Security Gate.

Whether to ignore case.

Whether to invert the match.

A regex pattern used to match, cannot be empty. If you need a pattern that matches every string use ".*"

The regular expression, which matches the parts which should be rewritten.

The rewrite expression.

pattern

Whether to ignore case.

A pattern for the header name.

A pattern for the header value.

A pattern for the header name.

A string to rewrite the header value with. Can make back-references to the header value pattern.

A pattern for the header value.

The name of the header to add.

The value of the header to add.

The actual pattern.

application

mapping

If the 'sub' claim should be extracted from the JWT and be used as audit token of the current session

All specified claims are checked and must match the claim's value of the decoded token. If a claim is an array, at least one entry must match the specified regex.

claim

The name of the claim you want to restrict.

The regular expression that must match the value of the specified claim name.

If the JWT standard claims expiry (exp) and not before (nbf) will be checked and must be valid.

From which cookie the token should be extracted.

How the token should be extracted from the request headers.

From which part of the request the token should be extracted. Possible values are 'header', 'parameter', 'cookie'.

From which query parameter the token should be extracted.

How the token should be extracted.

List of JWKS service providers referenced by their name. Can be local or remote providers.

If disabled, requests without a token are accepted. However, if a token is present,it is extracted and validated and the configured restrictions and role extractions are applied.

Specifies which roles should be extracted from the claims.

role

Name of the claim you want to extract a role from.

The regular expression to match the role extraction and the rewrite expression of the role.

If enabled, the expiry claim (exp) of the JWT will be used as the role lifetime.

Enforce a signed JWT

The allowed skew when checking expiry / not before in seconds.

The claim to extract the technical client id from.

allowed roles

A pattern to match the content type for this allow rule.

Enable the allow rule.

Whether to log requests not matching this allow rule instead of blocking them.

A pattern to match the http method for this allow rule.

Unique name for the allow rule. If omitted, a unique name will be generated. To enable/disable the default allow rule or one from a mapping_template_file, use the same name.

A pattern to match the path.

JSON objects are parsed only if their content-type matches the specified pattern.

If enabled, potential attack requests are only logged but not blocked.

The Microgateway mapping can be configured to rewrite the incoming URL to a different back-end URL (asymmetric mappings). Due to this rewriting, the incoming URL path (client_view) will be different from the back-end URL path (backend_view).

Check responses against API specification.

The OpenAPI specification.

The OpenAPI file path.

The specification to validate against.

If enabled, Microgateway parses JSON objects in requests and filters JSON attributes with allow rules and deny rules.

If enabled, each path segment is interpreted as a separate parameter value and the deny rules for parameter values are applied to it.

A list of access restrictions can be created. Each request matching the combination of HTTP method and path of a access restriction must have at least one of the specified roles to access the service. All matching restrictions must be satisfied to gain access.

access restriction

Can contain regular expressions that are applied when the HTTP method of a request matches one of the expressions. Use an empty pattern if all HTTP methods should match.

Can contain regular expressions that are applied when the requested path of the query matches the expressions. Use an empty pattern if all paths should match.

Can contain a list of roles for this service. Only sessions that have at least one of these roles will be able to access the service.

The client certificate verification mode to use on this mapping. This can be used to override the setting from the virtual host with a stronger verification level (e.g. off -> optional or optional -> required). Possible values are 'inherit', 'optional' or 'required'.

Defines the location of the authentication service. In case the required role for the mapping is missing on the current session, Airlock Gateway will redirect the client to this location. If this value is missing (default), the Global Denied Access URL will be used.

The authentication flow, allowed values are: redirect, deny_access, one_shot, one_shot_with_body, ntlm

In order to allow clean session termination on back-end systems when an Airlock Gateway session terminates, the administrator can configure one logout path per mapping.

Expert settings for the Security Gate.

host

The hostname of the back-end host. Only characters a-Z, numbers, and the special characters '.', ':',  '-' and '_' are allowed.

Configuring a back-end port.

Allowed values are: http, https

The unique name of the back-end. Only characters a-Z, numbers, and the special characters '.', ':',  '-' and '_' are allowed.

The back-end path specifies the internal back-end path, i.e. the path of the request sent to the application server.

Specifies whether Airlock Microgateway should compress the output on-the-fly for the client browser if supported and requested by the browser.

Specifies whether the connected back-end service is allowed to use the Airlock Microgateway Control API via the control cookie mechanism. The Control API is normally used by authentication applications to communicate with the Microgateway.

Cookies that should be cryptographically encrypted before being sent to the client.

Cookies that should be passed in plain format to the client.

Whether to enable automatic CSRF token injection and validation on this mapping.

All incoming URLs that match one of these patterns are accepted by Airlock Microgateway without a valid CSRF token.

exception

Specifies the location (e.g. /index.html) to which the client is redirected if a missing or invalid CSRF token is detected.

denied rule groups

Enable deny rule group

exception

Allowed values are: basic, standard, strict.

If enabled, offending requests are not blocked but only logged

If deny rule group key is defined, the settings will only affect the specific deny rule group.

Whether a trailing slash is mandatory at the end of the entry path or not.

Whether to ignore case.

Allowed values are: directory, regex.

This specifies the external URL path.

The entry path specifies the external URL path the mapping should be available under.

Specifies whether Airlock environment cookies containing useful request information are sent to the connected back-end.

Defines the maximum length of a parameter name in bytes.

Defines the maximum length for a parameter value in bytes.

Defines the maximum number of parameters inside the request.

A regular expression which specifies any parameters which should not be checked against these length checks.

The limits for HTTP parameters.

Defines the maximum number of items in a single JSON array (non-recursive).

Defines the maximum length for a JSON key, also known as 'JSON property' or 'JSON object member' in bytes.

Defines the maximum number of keys of a single JSON object (non-recursive).

Defines a regular expression to exclude JSON keys and the corresponding values from the length checks. The exceptions must be specified in the '#json' format for a JSON key.

Defines the maximum depth of nesting for JSON objects and JSON arrays.

Defines the maximum number of keys and array items in the whole JSON document (recursive).

Defines the maximum length for a JSON value (string or numbers) in bytes.

The limits for JSON structures.

Defines the maximum path length for requests to the current mapping in bytes.

The maximum allowed total size of the request body in bytes. It specifies the number of bytes from 0 (meaning unlimited) to 2147483647 (2GB) that are allowed in the request body. To restrict the size of file uploads, set this limit to the maximum combined size of all files uploaded at once.

The Airlock Gateway mapping template file path.

The unique name of the mapping.

Allowed values are: production, integration.

If enabled, requests are blocked if they contain the same parameter names with different parameter types (e.g. "id" is present as a POST parameter and as a query parameter simultaneously).

If enabled, offending requests are not blocked but only logged.

Exception pattern to exclude parameters from the parameter pollution detection.

If enabled, all the different values of a repeated parameter are joined by comma (in order of appearance). The aggregate value is then checked against deny rules (instead of the individual values).

Specifies the priority of this mapping (highest: -999, lowest: 999) when a request matches the entry path of multiple mappings.
All mappings with entry_path.type regex must have a unique priority.

A list of request custom actions executed in order of appearance. Only one action type (e.g. add_header or header_redirect) can be specified in each entry. Create multiple list positions if needed.

custom action

An action to add a header to all requests.

An action to add a header to all requests if it is not already present.

An action to add or replace an existing header to all requests.

A list of alpha-2 continent codes to redirect clients from. See here: https://en.wikipedia.org/wiki/List_of_sovereign_states_and_dependent_territories_by_continent_(data_file)

A list of country codes to redirect clients from. See here for alpha-2 codes to use: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2

The http status code to use on redirect

The url to redirect to.

An action to redirect to a URL based on the geographic location of the request source IP.

A pattern for the header name.

The http status code to use on redirect

The url to redirect to.

A pattern for the header value.

An action to redirect to a URL based on a header name or value either matching the given name or value pattern on requests.

A unique name for this action; if not specified, a unique name will be generated.

An action to remove a header either matching given name or value pattern on requests.

An action to rewrite a header value either matching given name or value pattern on requests.

A list of request custom actions executed in order of appearance. Only one action type (e.g. add_header or header_redirect) can be specified in each entry. Create multiple list positions if needed.

custom action

An action to add a header to all responses.

An action to add a header to all responses if it is not already present.

An action to add or replace an existing header on all responses.

A unique name for this action; if not specified, a unique name will be generated.

An action to remove a header either matching given name or value pattern on responses.

A pattern to match the name of the cookie to rewrite. If this is set the name of the cookie must match this pattern for the rewrite to happen.

A pattern to match the domain, or part of the domain of a cookie to rewrite it.

What to replace the domain with; Can make back references to the pattern used to match.

Whether to `add`, `keep` or `remove` the `HttpOnly` (see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#HttpOnly) flag on cookies. AUTO will set the flag for encrypted cookies and KEEP it for others.

A pattern to match the path of a response to rewrite.

What to replace the path with; Can make back references to the pattern used to match.

Whether to `add`, `keep` or `remove` the `Secure` (see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Secure) flag on cookies. AUTO will set the flag on all connections that use HTTPS and remove it on others.

An action to rewrite a cookie based on patterns for cookie name, domain etc.

An action to rewrite a header value either matching given name or value pattern on responses.

A string to rewrite value pattern matches in the cookie value. Can make back references to the pattern used for matching.

A pattern for the cookie value to apply for matching.

An action to rewrite the raw value of a cookie matching the given pattern.

Replacement rules for error responses returned by backend systems.

error page replacement

Error page file name that will be delivered to the client. (eg. 400.html)

The http response with the matching status code that should be replaced.

Rewrite the body of HTTP response.

rewrite

This regular expression pattern defines the content to rewrite.

A response from the back-end server is rewritten only if the response header «Content-Type» matches this regular expression.

This is the target string which will replace the string matched by Content Pattern

Rewriting HTML content may be necessary to modify URLs in the HTML content if the application creates absolute or incorrect links because it is not reverse proxy compatible

html

This list defines the content to rewrite. Possible values are 'url', event', 'embedded'.

This is the target string which will replace the string matched by URL Pattern

The URL pattern.

Rewrite the json body of http responses.

json

This regular expression pattern defines the content to rewrite.

The json path of the the property to rewrite.

This is the target content to replace the matched part with.

Rewrite option to modify the HTTP redirect location header sent from the back-end server before it is sent to the client.

location header

This is the target string which will replace the string matched by URL Pattern

The redirect URL pattern.

Allowed values are: enforce_session, optional_session, optional_session_no_refresh, ignore_session

Allowed values are: block, terminate_session, notify.

Defines the time in seconds Airlock Microgateway will wait for the back-end HTTP response. In case the request runs into the timeout, Airlock Microgateway will deliver an error page with the corresponding HTTP 503 status code.

Defines the minimum session idle time in seconds for this mapping. The value will be ignored if minimum session idle timeout is smaller or equal to the global session idle timeout setting.

Additional hostnames which refer to this virtual host.

The concatenated certificates of the CAs which are sent to the client during the SSL handshake, in PEM format.

The file containing the selection CA certificates.

The concatenated certificates of the CAs which are used as trust anchor during chain validation, in PEM format.

The file containing the validation CA certificates.

PEM representation of certificate revocation lists. If a client certificate is on such a list it will not be accepted. Although Airlock provides this functionality, it is recommended to check certificates against CRLs and other types of blacklists within the authentication service and not in Airlock.

The file containing the crl.

Defines the default verification mode for client certificates on this virtual host. Possible values are 'off', 'optional' or 'required'.

Maximum number of intermediate certificate issuers.

List of certificates of the CA chain for the certificate.

The CA chain file path.

The certificate in PEM format.

The certificate file path.

The private key for the certificate in PEM format.

The private key file path

Specifies whether encoded slashes (%2F) are allowed in URL path. Attention: combinations of client certificates per mapping and enabled encoded slashes in the same virtual host might result in configurations where client certificate evaluation might be evaded.

The hostname of the virtual host.

Specifies whether HTTP/2 connections are enabled for this host.

Specifies whether HTTP connections are enabled for this host.

Specifies the port on which this host listens for HTTP connections.

Specifies whether HTTPS connections are enabled for this host.

Specifies the port on which this host listens for HTTPS connections.

The logical name of the virtual host.

redirect

The destination can be relative to the current virtual host or an absolute URL including protocol and host. Relative redirect paths are extended with the incoming scheme and host header.

The absolute path starting with '/' as a regular expression from which to redirect.

The returned status code. Must be one of: [301, 302, 303, 307, 308]

Specifies the domain for Airlock's session cookie if the cookie is created inside this virtual host.

Specifies the cookie path for Airlock's session cookie if the cookie is created inside this virtual host.

Specifies whether a virtual host should reply only to requests that match the hostname or any of its server alias names.

Custom deny rule groups that can be referenced in mappings on top of the built in Airlock deny rules.

denied rule groups

Filter rule that blocks requests based on the evaluation of different request attributes.

denied rules

Unique name. In order to prevent overriding built-in deny rules, the name may not start with '(default)'.

Unique short name. In order to prevent overriding built-in deny rules, the name may not start with '(default)'.

Unique name. In order to prevent overriding built-in deny rule group, the name may not start with '(default)'.

Unique short name. In order to prevent overriding built-in deny rule group, the name may not start with '(default)'.

JWKS providers that are configured statically.

provider

Name of JWKS issuer. Corresponds to the 'Issuer' field in JWT.

JSON Object that represents the set of JWKS.

JSON file with the definitions of JWKS.

Name by which provider is referenced. Must be unique.

Refresh interval for fetching from remote JWKS providers in seconds.

Remote JWKS providers which are fetched according to the jwks_providers.refresh_interval.

provider

Name of JWKS issuer. This value is used to restrict the usage of the JWKS to JWTs with a matching issuer (claim 'iss').

URL of JWKS service provider.

tls

The TLS cipher suite to use. For documentation visit www.openssl.org and search for 'ciphers'.

List of certificates of the CA chain for the certificate.

The CA chain file path.

The certificate in PEM format.

The certificate file path.

The private key for the certificate in PEM format.

The private key file path

Force new session for each request.

The TLS protocol to use. For the description of the default values see the Gateway documentation for 'Supported SSL/TLS versions'.

The file containing the validation CA certificates.

Verification which involves a server identity check to mitigate man in the middle attacks.

JWKS Providers which can be referenced in apps[].mappings[].access_token.

The encoded license.

The license file path.

Allowed values are: info, trace

metrics

statsd

Enable sending of statsd metrics. Default is 'true'

Use this to enable sending metrics using the statsd protocol.

Configuration for metrics sending.

If set, Airlock Microgateway will treat the value of this header field as the useragent IP address.
Common values are 'X-Forwarded-For' or 'X-Client-IP'.
Warning: Make sure that internal_proxies is correctly configured for your setup.

List of hostnames, IP addresses or IP address ranges (e.g. 10.0.0.0/8) to trust as presenting a valid Remote-IP header.

Specifies the passphrase for the passphrase based encryption mechanism (PBE).

The path of the passphrase file.

Specifies the amount of idle time in seconds, after which an Airlock Microgateway session is terminated. This timeout should be smaller than all other session timeouts of your back-end applications. Even if the timeout can be configured in seconds, per default the resolution of the idle session timeout check is 5 seconds only.

Specifies the absolute lifetime of an Airlock Microgateway session in seconds. After this time a session will be terminated.

Name of the hosts running the Redis Server.

Defines the redis session store connection mode. By default, the Microgateway tries to determine the connection mode depending on the number of redis hosts configured:
- server mode if only one host is configured
- cluster mode if several hosts are configured

Allowed values are: server, cluster and disabled.

Provide a JSON object that satisfies the schema "airlock-microgateway-3.2". Here are the required top‑level fields: none (all optional). Return only the valid JSON object.


[System]
You are a helpful assistant that answers strictly in JSON. Here's the JSON schema you must adhere to:
<schema>
{"$schema":"http://json-schema.org/draft-07/schema#","title":"K9s aliases schema","type":"object","additionalProperties":false,"properties":{"aliases":{"type":"object","additionalProperties":{"type":"string"},"required":[]}},"required":["aliases"]}
</schema>

[User] Provide a JSON object that satisfies the schema "K9s aliases schema". Here are the required top‑level fields: aliases. Return only the valid JSON object.

K9s aliases schema

Provide a JSON object that satisfies the schema "K9s aliases schema". Here are the required top‑level fields: aliases. Return only the valid JSON object.


[System]
You are a helpful assistant that answers strictly in JSON. Here's the JSON schema you must adhere to:
<schema>
{"$schema":"http://json-schema.org/draft-04/schema#","additionalProperties":false,"definitions":{},"description":"The configuration file used by the All Contributors CLI and GitHub bot.\nhttps://allcontributors.org/docs/en/bot/configuration","id":"https://json.schemastore.org/base-04.json","properties":{"projectName":{"title":"Name of the project","type":"string","minLength":0},"projectOwner":{"title":"Name of the user the project is hosted by","type":"string","minLength":0},"repoType":{"title":"Type of repository","enum":["github","gitlab"],"default":"github"},"repoHost":{"title":"Points to the repository hostname","description":"Change it if you use a self-hosted repository.\nDefault: https://github.com if repoType is github, and https://gitlab.com if repoType is gitlab","type":"string","minLength":0},"files":{"title":"Array of files to update","type":"array","items":{"type":"string","minLength":0},"default":["README.md"]},"imageSize":{"title":"Size (in px) of the user's avatar","type":"number","minimum":0,"default":100},"commit":{"title":"Auto-commit badge when adding contributors","type":"boolean","default":false},"commitConvention":{"title":"Commit convention","enum":["angular","atom","ember","eslint","jshint","gitmoji","none"],"default":"angular"},"commitType":{"description":"UNDOCUMENTED: Sets Conventional Commits commit type to be used by the all contributors bot. See https://www.conventionalcommits.org.","type":"string","default":"docs"},"contributorsPerLine":{"title":"Maximum number of columns for the contributors table","type":"number","minimum":0,"default":7},"contributorsSortAlphabetically":{"title":"true: Sort alphabetically. false: Display in order of addition.","type":"boolean","default":false},"badgeTemplate":{"title":"Your own lodash template to generate the badge","type":"string","minLength":0},"contributorTemplate":{"title":"Your own lodash template to generate the contributor","type":"string","minLength":0},"types":{"title":"Custom symbols or link templates for contribution types (can override the documented types)","type":"object","additionalProperties":{"type":"object","properties":{"symbol":{"title":"Symbol to use for the contribution type","type":"string","minLength":0},"description":{"title":"Description of the contribution type","type":"string","minLength":0},"link":{"title":"Link to use for the contribution type","type":"string","minLength":0}}}},"linkToUsage":{"title":"Adds a footer with link to usage","type":"boolean","default":true},"skipCi":{"title":"Makes the CI ignore the commit","type":"boolean","default":true},"contributors":{"title":"List of contributors for this project","type":"array","items":{"type":"object","additionalProperties":false,"properties":{"login":{"title":"Github username of the contributor","type":"string","minLength":0},"name":{"title":"Name of the contributor","type":"string","minLength":0},"avatar_url":{"title":"URL of the contributor's avatar","type":"string","format":"uri","minLength":0},"profile":{"title":"URL of the contributor's profile page or website","type":"string","format":"uri","minLength":0},"contributions":{"title":"Array of contributions made by the contributor","type":"array","minItems":1,"items":{"anyOf":[{"type":"string","enum":["a11y","audio","blog","bug","business","code","content","data","design","doc","eventOrganizing","example","financial","fundingFinding","ideas","infra","maintenance","mentoring","platform","plugin","projectManagement","promotion","question","research","review","security","talk","test","tool","translation","tutorial","userTesting","video"]},{"type":"string","minLength":0}]}}},"required":["login","name","avatar_url","profile","contributions"]}}},"required":["projectName","projectOwner"],"title":"All Contributors configuration file","type":"object"}
</schema>

[User] Provide a JSON object that satisfies the schema "All Contributors configuration file". Here are the required top‑level fields: projectName, projectOwner. Return only the valid JSON object.

The configuration file used by the All Contributors CLI and GitHub bot.
https://allcontributors.org/docs/en/bot/configuration

Name of the project

Name of the user the project is hosted by

Type of repository

Points to the repository hostname

Change it if you use a self-hosted repository.
Default: https://github.com if repoType is github, and https://gitlab.com if repoType is gitlab

Array of files to update

Size (in px) of the user's avatar

Auto-commit badge when adding contributors

Commit convention

angular atom ember eslint jshint gitmoji none

UNDOCUMENTED: Sets Conventional Commits commit type to be used by the all contributors bot. See https://www.conventionalcommits.org.

Maximum number of columns for the contributors table

true: Sort alphabetically. false: Display in order of addition.

Your own lodash template to generate the badge

Your own lodash template to generate the contributor

Custom symbols or link templates for contribution types (can override the documented types)

Symbol to use for the contribution type

Description of the contribution type

Link to use for the contribution type

Adds a footer with link to usage

Makes the CI ignore the commit

List of contributors for this project

Github username of the contributor

Name of the contributor

URL of the contributor's avatar

URL of the contributor's profile page or website

Array of contributions made by the contributor

a11y audio blog bug business code content data design doc eventOrganizing example financial fundingFinding ideas infra maintenance mentoring platform plugin projectManagement promotion question research review security talk test tool translation tutorial userTesting video

login name avatar_url profile contributions

All Contributors configuration file

Provide a JSON object that satisfies the schema "All Contributors configuration file". Here are the required top‑level fields: projectName, projectOwner. Return only the valid JSON object.


[System]
You are a helpful assistant that answers strictly in JSON. Here's the JSON schema you must adhere to:
<schema>
{"$id":"http://asyncapi.com/schema-store/all.schema-store.json","$schema":"http://json-schema.org/draft-07/schema","title":"JSON Schema documents for all AsyncAPI spec versions","description":"All AsyncAPI JSON Schema documents listed in one file. Needed for serving all documents through schemastore.org","type":"object","oneOf":[{"allOf":[{"properties":{"asyncapi":{"const":"1.0.0"}}},{"$ref":"http://asyncapi.com/schema-store/1.0.0-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"1.1.0"}}},{"$ref":"http://asyncapi.com/schema-store/1.1.0-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"1.2.0"}}},{"$ref":"http://asyncapi.com/schema-store/1.2.0-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"2.0.0-rc1"}}},{"$ref":"http://asyncapi.com/schema-store/2.0.0-rc1-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"2.0.0-rc2"}}},{"$ref":"http://asyncapi.com/schema-store/2.0.0-rc2-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"2.0.0"}}},{"$ref":"http://asyncapi.com/schema-store/2.0.0-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"2.1.0"}}},{"$ref":"http://asyncapi.com/schema-store/2.1.0-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"2.2.0"}}},{"$ref":"http://asyncapi.com/schema-store/2.2.0-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"2.3.0"}}},{"$ref":"http://asyncapi.com/schema-store/2.3.0-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"2.4.0"}}},{"$ref":"http://asyncapi.com/schema-store/2.4.0-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"2.5.0"}}},{"$ref":"http://asyncapi.com/schema-store/2.5.0-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"2.6.0"}}},{"$ref":"http://asyncapi.com/schema-store/2.6.0-without-$id.json"}]},{"allOf":[{"properties":{"asyncapi":{"const":"3.0.0"}}},{"$ref":"http://asyncapi.com/schema-store/3.0.0-without-$id.json"}]}]}
</schema>

[User] Provide a JSON object that satisfies the schema "JSON Schema documents for all AsyncAPI spec versions". Here are the required top‑level fields: none (all optional). Return only the valid JSON object.

All AsyncAPI JSON Schema documents listed in one file. Needed for serving all documents through schemastore.org

Provide a JSON object that satisfies the schema "JSON Schema documents for all AsyncAPI spec versions". Here are the required top‑level fields: none (all optional). Return only the valid JSON object.


[System]
You are a helpful assistant that answers strictly in JSON. Here's the JSON schema you must adhere to:
<schema>
{"$schema":"http://json-schema.org/draft-07/schema#","$id":"https://json.schemastore.org/amx-muse.json","description":"A MUSE program descriptor file","additionalProperties":true,"type":"object","properties":{"id":{"title":"Program ID","description":"Globally unique program ID, special characters are not allowed","type":"string","pattern":"^[a-zA-z0-9_-]+$"},"description":{"title":"Program Description","description":"A description of the program that may be used by user interfaces","type":"string"},"disabled":{"title":"Auto-start Disabled","description":"Disable the auto-start of the script on system boot","type":"boolean","default":false},"envvars":{"title":"Environment Variables","description":"Name/Value pairs that can be used to set configuration of a program","type":"object","additionalProperties":{"type":"string"}},"scope":{"title":"Program Scope","description":"The scope (location) to which the script belongs. Leave blank for global scope","type":"string","pattern":"^[a-zA-z0-9_\\.-]*$"},"provider":{"title":"Programming Language","description":"The language the program is written in","enum":["groovy","javascript","python"]},"script":{"title":"Program File Name","description":"The file name of the main entry point of the program. Defaults to index.<extension>","type":"string","default":"index.{groovy,js,py}"}},"required":["id","provider"]}
</schema>

[User] Provide a JSON object that satisfies the schema "amx-muse". Here are the required top‑level fields: id, provider. Return only the valid JSON object.

A MUSE program descriptor file

Program ID

Globally unique program ID, special characters are not allowed

Program Description

A description of the program that may be used by user interfaces

Auto-start Disabled

Disable the auto-start of the script on system boot

Environment Variables

Name/Value pairs that can be used to set configuration of a program

Program Scope

The scope (location) to which the script belongs. Leave blank for global scope

Programming Language

The language the program is written in

Program File Name

The file name of the main entry point of the program. Defaults to index.<extension>

Provide a JSON object that satisfies the schema "amx-muse". Here are the required top‑level fields: id, provider. Return only the valid JSON object.


[System]
You are a helpful assistant that answers strictly in JSON. Here's the JSON schema you must adhere to:
<schema>
{"$defs":{"rule":{"additionalProperties":false,"properties":{"exclude_paths":{"items":{"type":"string"},"title":"Glob-like paths to be excluded.","type":"array"}},"type":"object"}},"$id":"https://raw.githubusercontent.com/ansible/ansible-lint/main/src/ansiblelint/schemas/ansible-lint-config.json","$schema":"http://json-schema.org/draft-07/schema","additionalProperties":false,"description":"https://ansible.readthedocs.io/projects/lint/configuring/","examples":[".ansible-lint",".ansible-lint.yml",".ansible-lint.yaml",".config/ansible-lint.yml",".config/ansible-lint.yaml"],"properties":{"display_relative_path":{"default":true,"title":"Configure how to display file paths","type":"boolean"},"enable_list":{"items":{"type":"string"},"title":"Enable List","type":"array"},"exclude_paths":{"items":{"type":"string"},"title":"Exclude Paths","type":"array"},"extra_vars":{"title":"Extra Vars","type":"object"},"kinds":{"items":{"additionalProperties":{"type":"string"},"type":"object"},"title":"Kinds","type":"array"},"loop_var_prefix":{"title":"Loop Var Prefix","type":"string"},"max_block_depth":{"title":"Maximum Block Depth","type":"integer","default":20},"mock_modules":{"items":{"type":"string"},"title":"Mock Modules","type":"array"},"mock_roles":{"items":{"type":"string"},"title":"Mock Roles","type":"array"},"offline":{"default":false,"title":"Offline","type":"boolean"},"only_builtins_allow_collections":{"items":{"type":"string"},"title":"Only Builtins Allow Collections","type":"array"},"only_builtins_allow_modules":{"items":{"type":"string"},"title":"Only Builtins Allow Modules","type":"array"},"parseable":{"default":true,"title":"Parseable","type":"boolean"},"profile":{"enum":["min","basic","moderate","safety","shared","production",null],"title":"Profile","type":["null","string"]},"progressive":{"default":false,"title":"Progressive (removed feature)","type":"boolean"},"project_dir":{"default":null,"title":"Project Directory","type":["string","null"]},"quiet":{"default":true,"title":"Quiet","type":"boolean"},"rules":{"additionalProperties":{"$ref":"#/$defs/rule"},"propertyNames":{"oneOf":[{"enum":["command-instead-of-module","command-instead-of-shell","deprecated-bare-vars","deprecated-local-action","deprecated-module","empty-string-compare","fqcn","fqcn[action-core]","fqcn[action]","fqcn[canonical]","fqcn[keyword]","galaxy","galaxy[no-changelog]","galaxy[no-runtime]","galaxy[tags]","galaxy[version-incorrect]","galaxy[version-missing]","ignore-errors","inline-env-var","internal-error","jinja","jinja[invalid]","jinja[spacing]","key-order","latest","literal-compare","load-failure","load-failure[not-found]","loop-var-prefix","loop-var-prefix[missing]","loop-var-prefix[wrong]","meta-incorrect","meta-no-tags","meta-runtime","meta-video-links","name","name[casing]","name[play]","name[prefix]","name[template]","no-changed-when","no-handler","no-jinja-when","no-log-password","no-prompting","no-relative-paths","no-same-owner","no-tabs","only-builtins","package-latest","parser-error","partial-become","playbook-extension","risky-file-permissions","risky-octal","risky-shell-pipe","role-name","run-once","run-once[play]","run-once[task]","sanity","sanity[bad-ignore]","sanity[cannot-ignore]","schema","syntax-check","var-naming","yaml"],"type":"string"},{"pattern":"^[a-z0-9-\\[\\]]+$","type":"string"}]},"title":"Rules specific configuration.","type":"object"},"rulesdir":{"items":{"type":"string"},"title":"Rulesdir","type":"array"},"sarif_file":{"default":null,"title":"SARIF Output filename","type":["null","string"]},"skip_action_validation":{"default":false,"title":"Skip Action Validation","type":"boolean"},"skip_list":{"items":{"type":"string"},"title":"Skip List","type":"array"},"strict":{"default":false,"title":"Strict","type":"boolean"},"supported_ansible_also":{"items":{"type":"string"},"title":"Add supported ansible versions","type":"array"},"tags":{"items":{"type":"string"},"title":"Tags","type":"array"},"task_name_prefix":{"default":"{stem} | ","title":"Allow custom prefix for task[prefix]","type":"string"},"use_default_rules":{"default":true,"title":"Use Default Rules","type":"boolean"},"var_naming_pattern":{"default":"^[a-z_][a-z0-9_]*$","title":"Regex used to verify variable names","type":"string"},"verbosity":{"default":0,"title":"Verbosity","type":"integer"},"warn_list":{"items":{"type":"string"},"title":"Warn List","type":"array"},"write_exclude_list":{"items":{"type":"string"},"title":"Write Exclude List","type":"array"},"write_list":{"items":{"type":"string"},"title":"Write List","type":"array"}},"title":"Ansible-lint Configuration Schema","type":"object"}
</schema>

[User] Provide a JSON object that satisfies the schema "Ansible-lint Configuration Schema". Here are the required top‑level fields: none (all optional). Return only the valid JSON object.

Glob-like paths to be excluded.

Configure how to display file paths

Enable List

Exclude Paths

Extra Vars

Kinds

Loop Var Prefix

Maximum Block Depth

Mock Modules

Mock Roles

Offline

Only Builtins Allow Collections

Only Builtins Allow Modules

Parseable

Profile

Progressive (removed feature)

Project Directory

Quiet

command-instead-of-module command-instead-of-shell deprecated-bare-vars deprecated-local-action deprecated-module empty-string-compare fqcn fqcn[action-core] fqcn[action] fqcn[canonical] fqcn[keyword] galaxy galaxy[no-changelog] galaxy[no-runtime] galaxy[tags] galaxy[version-incorrect] galaxy[version-missing] ignore-errors inline-env-var internal-error jinja jinja[invalid] jinja[spacing] key-order latest literal-compare load-failure load-failure[not-found] loop-var-prefix loop-var-prefix[missing] loop-var-prefix[wrong] meta-incorrect meta-no-tags meta-runtime meta-video-links name name[casing] name[play] name[prefix] name[template] no-changed-when no-handler no-jinja-when no-log-password no-prompting no-relative-paths no-same-owner no-tabs only-builtins package-latest parser-error partial-become playbook-extension risky-file-permissions risky-octal risky-shell-pipe role-name run-once run-once[play] run-once[task] sanity sanity[bad-ignore] sanity[cannot-ignore] schema syntax-check var-naming yaml

Rules specific configuration.

Rulesdir

SARIF Output filename

Skip Action Validation

Skip List

Strict

Add supported ansible versions

Tags

Allow custom prefix for task[prefix]

Use Default Rules

Regex used to verify variable names

Verbosity

Warn List

Write Exclude List

Write List

Ansible-lint Configuration Schema

Provide a JSON object that satisfies the schema "Ansible-lint Configuration Schema". Here are the required top‑level fields: none (all optional). Return only the valid JSON object.