---
title: "POST /v1/{+parent}/authzExtensions"
method: POST
path: "/v1/{+parent}/authzExtensions"
tags: ["projects"]
---

# POST /v1/{+parent}/authzExtensions

`POST /v1/{+parent}/authzExtensions`

Creates a new `AuthzExtension` resource in a given project and location.

## Path parameters

- `parent` string, required

## Query parameters

- `authzExtensionId` string
- `requestId` string

## Request body

- AuthzExtension — `AuthzExtension` is a resource that allows traffic forwarding to a callout backend service to make an authorization decision.
  - `name` string — Required. Identifier. Name of the `AuthzExtension` resource in the following format: `projects/{project}/locations/{location}/authzExtensions/{authz_extension}`.
  - `createTime` string, google-datetime — Output only. The timestamp when the resource was created.
  - `updateTime` string, google-datetime — Output only. The timestamp when the resource was updated.
  - `description` string — Optional. A human-readable description of the resource.
  - `labels` object — Optional. Set of labels associated with the `AuthzExtension` resource. The format must comply with [the requirements for labels](/compute/docs/labeling-resources#requirements) for Google Cloud resources.
  - `loadBalancingScheme` 'LOAD_BALANCING_SCHEME_UNSPECIFIED' | 'INTERNAL_MANAGED' | 'EXTERNAL_MANAGED' — Optional. All backend services and forwarding rules referenced by this extension must share the same load balancing scheme. Supported values: `INTERNAL_MANAGED`, `EXTERNAL_MANAGED`. Can be omitted for AuthzExtensions that do not reference a backend service. For more information, refer to [Backend services overview](https://cloud.google.com/load-balancing/docs/backend-service).
  - `authority` string — Optional. The `:authority` header in the gRPC request sent from Envoy to the extension service. It is required when the `service` field points to a backend service or a wasm plugin.
  - `service` string — Required. The reference to the service that runs the extension. To configure a callout extension, `service` must be a fully-qualified reference to a [backend service](https://cloud.google.com/compute/docs/reference/rest/v1/backendServices) in the format: `https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/backendServices/{backendService}` or `https://www.googleapis.com/compute/v1/projects/{project}/global/backendServices/{backendService}`.
  - `timeout` string, google-duration — Required. Specifies the timeout for each individual message on the stream. The timeout must be between 10-10000 milliseconds.
  - `failOpen` boolean — Optional. Determines how the proxy behaves if the call to the extension fails or times out. When set to `TRUE`, request or response processing continues without error. Any subsequent extensions in the extension chain are also executed. When set to `FALSE` or the default setting of `FALSE` is used, one of the following happens: * If response headers have not been delivered to the downstream client, a generic 500 error is returned to the client. The error response can be tailored by configuring a custom error response in the load balancer. * If response headers have been delivered, then the HTTP stream to the downstream client is reset.
  - `metadata` object — Optional. The metadata provided here is included as part of the `metadata_context` (of type `google.protobuf.Struct`) in the `ProcessingRequest` message sent to the extension server. The metadata is available under the namespace `com.google.authz_extension.`. The following variables are supported in the metadata Struct: `{forwarding_rule_id}` - substituted with the forwarding rule's fully qualified resource name.
  - `forwardHeaders` string[] — Optional. List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.
  - `forwardAttributes` string[] — Optional. List of the Envoy attributes to forward to the extension server. The attributes provided here are included as part of the `ProcessingRequest.attributes` field (of type `map`), where the keys are the attribute names. Refer to the [documentation](https://cloud.google.com/service-extensions/docs/cel-matcher-language-reference#attributes) for the names of attributes that can be forwarded. If omitted, no attributes are sent. Each element is a string indicating the attribute name.
  - `wireFormat` 'WIRE_FORMAT_UNSPECIFIED' | 'EXT_PROC_GRPC' | 'EXT_AUTHZ_GRPC' — Optional. The format of communication supported by the callout extension. This field is supported only for regional `AuthzExtension` resources. If not specified, the default value `EXT_PROC_GRPC` is used. Global `AuthzExtension` resources use the `EXT_PROC_GRPC` wire format.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/networkservices.md) · [All operations](https://skmtc.net/google/apis/networkservices/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/networkservices/versions/ff841dec54e1/schema)