Sign in

v1

latestOpenAPI 3.0.0Creative Commons Attribution 3.02026-07-1346116213.0 KB
projects

Creates a new AuthzExtension resource in a given project and location.

post/v1/{+parent}/authzExtensions

Path parameters

parentstring required

Required. The parent resource of the AuthzExtension resource. Must be in the format projects/{project}/locations/{location}.

Query parameters

authzExtensionIdstring

Required. User-provided ID of the AuthzExtension resource to be created.

requestIdstring

Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server can ignore the request if it has already been completed. The server guarantees that for 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server ignores the second request This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).

Request body

namestring

Required. Identifier. Name of the AuthzExtension resource in the following format: projects/{project}/locations/{location}/authzExtensions/{authz_extension}.

createTimestring google-datetime

Output only. The timestamp when the resource was created.

updateTimestring google-datetime

Output only. The timestamp when the resource was updated.

descriptionstring

Optional. A human-readable description of the resource.

labelsobject

Optional. Set of labels associated with the AuthzExtension resource. The format must comply with the requirements for labels for Google Cloud resources.

loadBalancingScheme'LOAD_BALANCING_SCHEME_UNSPECIFIED' | 'INTERNAL_MANAGED' | 'EXTERNAL_MANAGED'

Optional. All backend services and forwarding rules referenced by this extension must share the same load balancing scheme. Supported values: INTERNAL_MANAGED, EXTERNAL_MANAGED. Can be omitted for AuthzExtensions that do not reference a backend service. For more information, refer to Backend services overview.

authoritystring

Optional. The :authority header in the gRPC request sent from Envoy to the extension service. It is required when the service field points to a backend service or a wasm plugin.

servicestring

Required. The reference to the service that runs the extension. To configure a callout extension, service must be a fully-qualified reference to a backend service in the format: https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/backendServices/{backendService} or https://www.googleapis.com/compute/v1/projects/{project}/global/backendServices/{backendService}.

timeoutstring google-duration

Required. Specifies the timeout for each individual message on the stream. The timeout must be between 10-10000 milliseconds.

failOpenboolean

Optional. Determines how the proxy behaves if the call to the extension fails or times out. When set to TRUE, request or response processing continues without error. Any subsequent extensions in the extension chain are also executed. When set to FALSE or the default setting of FALSE is used, one of the following happens: * If response headers have not been delivered to the downstream client, a generic 500 error is returned to the client. The error response can be tailored by configuring a custom error response in the load balancer. * If response headers have been delivered, then the HTTP stream to the downstream client is reset.

metadataobject

Optional. The metadata provided here is included as part of the metadata_context (of type google.protobuf.Struct) in the ProcessingRequest message sent to the extension server. The metadata is available under the namespace com.google.authz_extension.. The following variables are supported in the metadata Struct: {forwarding_rule_id} - substituted with the forwarding rule's fully qualified resource name.

forwardHeadersstring[]

Optional. List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.

forwardAttributesstring[]

Optional. List of the Envoy attributes to forward to the extension server. The attributes provided here are included as part of the ProcessingRequest.attributes field (of type map), where the keys are the attribute names. Refer to the documentation for the names of attributes that can be forwarded. If omitted, no attributes are sent. Each element is a string indicating the attribute name.

wireFormat'WIRE_FORMAT_UNSPECIFIED' | 'EXT_PROC_GRPC' | 'EXT_AUTHZ_GRPC'

Optional. The format of communication supported by the callout extension. This field is supported only for regional AuthzExtension resources. If not specified, the default value EXT_PROC_GRPC is used. Global AuthzExtension resources use the EXT_PROC_GRPC wire format.

Response

Successful response