{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "#/components/schemas/HeaderCertAuthPluginConfig",
  "title": "HeaderCertAuthPluginConfig",
  "x-speakeasy-entity": "PluginHeaderCertAuth",
  "properties": {
    "config": {
      "type": "object",
      "properties": {
        "allow_partial_chain": {
          "description": "Allow certificate verification with only an intermediate certificate. When this is enabled, you don't need to upload the full chain to Kong Certificates.",
          "type": "boolean",
          "default": false
        },
        "anonymous": {
          "description": "An optional string (consumer UUID or username) value to use as an \u201canonymous\u201d consumer if authentication fails. If empty (default null), the request fails with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
          "type": "string"
        },
        "authenticated_group_by": {
          "description": "Certificate property to use as the authenticated group. Valid values are `CN` (Common Name) or `DN` (Distinguished Name). Once `skip_consumer_lookup` is applied, any client with a valid certificate can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL plugin (not covered here) and create allowed or denied groups of users.",
          "type": "string",
          "default": "CN",
          "enum": [
            "CN",
            "DN"
          ]
        },
        "ca_certificates": {
          "description": "List of CA Certificates strings to use as Certificate Authorities (CA) when validating a client certificate. At least one is required but you can specify as many as needed. The value of this array is comprised of primary keys (`id`).",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "cache_ttl": {
          "description": "Cache expiry time in seconds.",
          "type": "number",
          "default": 60
        },
        "cert_cache_ttl": {
          "description": "The length of time in milliseconds between refreshes of the revocation check status cache.",
          "type": "number",
          "default": 60000
        },
        "certificate_header_format": {
          "description": "Format of the certificate header. Supported formats: `base64_encoded`, `url_encoded`.",
          "type": "string",
          "enum": [
            "base64_encoded",
            "url_encoded"
          ]
        },
        "certificate_header_name": {
          "description": "Name of the header that contains the certificate, received from the WAF or other L7 downstream proxy.",
          "type": "string"
        },
        "consumer_by": {
          "description": "Whether to match the subject name of the client-supplied certificate against consumer's `username` and/or `custom_id` attribute. If set to `[]` (the empty array), then auto-matching is disabled.",
          "type": "array",
          "items": {
            "enum": [
              "custom_id",
              "username"
            ],
            "type": "string"
          },
          "default": [
            "custom_id",
            "username"
          ]
        },
        "default_consumer": {
          "description": "The UUID or username of the consumer to use when a trusted client certificate is presented but no consumer matches. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.",
          "type": "string"
        },
        "http_proxy_host": {
          "description": "A string representing a host name, such as example.com.",
          "type": "string"
        },
        "http_proxy_port": {
          "description": "An integer representing a port number between 0 and 65535, inclusive.",
          "type": "integer",
          "maximum": 65535,
          "minimum": 0
        },
        "http_timeout": {
          "description": "HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.",
          "type": "number",
          "default": 30000
        },
        "https_proxy_host": {
          "description": "A string representing a host name, such as example.com.",
          "type": "string"
        },
        "https_proxy_port": {
          "description": "An integer representing a port number between 0 and 65535, inclusive.",
          "type": "integer",
          "maximum": 65535,
          "minimum": 0
        },
        "revocation_check_mode": {
          "description": "Controls client certificate revocation check behavior. If set to `SKIP`, no revocation check is performed. If set to `IGNORE_CA_ERROR`, the plugin respects the revocation status when either OCSP or CRL URL is set, and doesn't fail on network issues. If set to `STRICT`, the plugin only treats the certificate as valid when it's able to verify the revocation status.",
          "type": "string",
          "default": "IGNORE_CA_ERROR",
          "enum": [
            "IGNORE_CA_ERROR",
            "SKIP",
            "STRICT"
          ]
        },
        "secure_source": {
          "description": "Whether to secure the source of the request. If set to `true`, the plugin will only allow requests from trusted IPs (configured by the `trusted_ips` config option).",
          "type": "boolean",
          "default": true
        },
        "skip_consumer_lookup": {
          "description": "Skip consumer lookup once certificate is trusted against the configured CA list.",
          "type": "boolean",
          "default": false
        },
        "ssl_verify": {
          "description": "This option enables verification of the certificate presented by the server of the OCSP responder's URL and by the server of the CRL Distribution Point.",
          "type": "boolean",
          "default": true
        }
      },
      "required": [
        "ca_certificates",
        "certificate_header_format",
        "certificate_header_name"
      ]
    },
    "name": {
      "const": "header-cert-auth"
    },
    "protocols": {
      "description": "A set of strings representing HTTP protocols.",
      "type": "array",
      "items": {
        "enum": [
          "grpc",
          "grpcs",
          "http",
          "https"
        ],
        "type": "string"
      },
      "format": "set",
      "default": [
        "grpc",
        "grpcs",
        "http",
        "https"
      ]
    },
    "route": {
      "description": "If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "id": {
          "type": "string"
        }
      }
    },
    "service": {
      "description": "If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "id": {
          "type": "string"
        }
      }
    }
  },
  "required": [
    "config"
  ]
}