Policy catalog

The repository currently carries 34 versioned policy manifests. A manifest means the authoring contract exists; consult each policy’s detailed documentation and release notes before depending on advanced behavior in production.

Identity and access

Type	Purpose
`api-key/v1`	Resolve an application from a key in a header or query parameter.
`basic-auth/v1`	Verify an HTTP Basic credential.
`oauth2-verify/v1`	Validate a bearer token and resolve API-product access.
`jwt-verify/v1`	Validate issuer, audience, signature, algorithm, and claims.
`jwt-generate/v1`	Generate a signed token for an upstream service.
`hmac-verify/v1`	Authenticate signed requests.
`mtls-verify/v1`	Verify a client certificate or trusted forwarded identity.

Traffic and resilience

Type	Purpose
`quota/v1`	Enforce a fixed or plan-derived allowance over a time window.
`spike-arrest/v1`	Smooth bursts independently of longer quota windows.
`concurrency-limit/v1`	Bound simultaneous work.
`timeout/v1`	Set an upstream execution deadline.
`retry/v1`	Retry eligible upstream failures.
`circuit-breaker/v1`	Stop calls to a failing upstream until recovery criteria are met.
`traffic-split/v1`	Select between targets by configured weights.
`cache/v1`	Cache eligible responses.

Transformation and composition

Type	Purpose
`transform-headers/v1`	Add, set, rename, or remove request and response headers.
`transform-body/v1`	Transform supported buffered message bodies.
`extract-variables/v1`	Extract values from headers, paths, queries, or JSON bodies.
`url-rewrite/v1`	Rewrite outbound paths or query parameters.
`service-callout/v1`	Call an auxiliary HTTP service from a flow.
`kv-lookup/v1`	Resolve a value from an environment key-value map.
`callout/v1`	Run bundle-owned JavaScript or Python logic.

Protection and validation

Type	Purpose
`ip-restriction/v1`	Allow or deny caller address ranges.
`request-size-limit/v1`	Reject oversized requests before expensive processing.
`request-validate/v1`	Validate supported request properties against an API contract.
`threat-protection/v1`	Enforce bounded structural limits on request content.
`bot-detection/v1`	Apply configured bot indicators and actions.

Response and operations

Type	Purpose
`cors/v1`	Apply Cross-Origin Resource Sharing behavior.
`fault/v1`	Shape a controlled fault response.
`mock-response/v1`	Return a configured response without an upstream call.
`request-terminate/v1`	End a flow with an explicit response.
`correlation-id/v1`	Create and propagate a request identifier.
`message-logging/v1`	Emit structured flow information to supported sinks.
`metrics-collector/v1`	Record bounded custom metrics.