{ "$schema": "https://json-schema.org/draft/2019-09/schema", "title": "Bifrost Helm Chart Values", "description": "Schema for Bifrost Helm chart values.yaml", "type": "object", "properties": { "replicaCount": { "type": "integer", "minimum": 1, "description": "Number of Bifrost replicas" }, "image": { "type": "object", "properties": { "repository": { "type": "string", "description": "Container image repository" }, "pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"], "description": "Image pull policy" }, "tag": { "type": "string", "description": "Image tag (required - validated at template render time)" } } }, "imagePullSecrets": { "type": "array", "items": { "type": "object" } }, "nameOverride": { "type": "string" }, "fullnameOverride": { "type": "string" }, "serviceAccount": { "type": "object", "properties": { "create": { "type": "boolean" }, "automount": { "type": "boolean" }, "annotations": { "type": "object" }, "name": { "type": "string" } } }, "rbac": { "type": "object", "properties": { "podDiscovery": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Create namespaced Role/RoleBinding for Kubernetes pod discovery when cluster discovery type is kubernetes" } }, "additionalProperties": false } }, "additionalProperties": false }, "deploymentAnnotations": { "type": "object" }, "deploymentLabels": { "type": "object" }, "podAnnotations": { "type": "object" }, "podLabels": { "type": "object" }, "podSecurityContext": { "type": "object" }, "securityContext": { "type": "object" }, "service": { "type": "object", "properties": { "type": { "type": "string", "enum": ["ClusterIP", "NodePort", "LoadBalancer"] }, "port": { "type": "integer", "minimum": 1, "maximum": 65535 }, "annotations": { "type": "object" } } }, "ingress": { "description": "Ingress configuration. Either a single ingress (legacy, with top-level 'enabled') or a map of named ingresses (new format, each key becomes a separate Ingress resource named -).", "oneOf": [ { "type": "object", "description": "Single ingress (legacy format).", "properties": { "enabled": { "type": "boolean" }, "className": { "type": "string" }, "ingressClassName": { "type": "string", "description": "Meesho Contour ingress class used by the retained HTTPProxy templates" }, "servicePortNumber": { "type": "integer", "minimum": 1, "maximum": 65535 }, "enableWebsocket": { "type": "boolean" }, "slowStart": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "window": { "type": ["string", "integer"] }, "aggression": { "type": "number" }, "minPercent": { "type": "integer", "minimum": 0, "maximum": 100 } }, "additionalProperties": false }, "annotations": { "type": "object" }, "hosts": { "type": "array", "items": { "type": "object", "required": ["host", "paths"], "properties": { "host": { "type": "string" }, "paths": { "type": "array", "items": { "type": "object", "required": ["path", "pathType"], "properties": { "path": { "type": "string" }, "pathType": { "type": "string", "enum": ["Prefix", "Exact", "ImplementationSpecific"] } } } } } } }, "tls": { "type": "array" } }, "required": ["enabled"] }, { "type": "object", "description": "Named ingresses map. Each key produces a separate Ingress named -. Keys must be valid DNS-1123 label segments (lowercase alphanumeric and hyphens only, no underscores or uppercase) so the resulting Ingress name is a valid Kubernetes resource name.", "additionalProperties": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "className": { "type": "string" }, "annotations": { "type": "object" }, "hosts": { "type": "array", "items": { "type": "object", "required": ["host", "paths"], "properties": { "host": { "type": "string" }, "paths": { "type": "array", "items": { "type": "object", "required": ["path", "pathType"], "properties": { "path": { "type": "string" }, "pathType": { "type": "string", "enum": ["Prefix", "Exact", "ImplementationSpecific"] } } } } } } }, "tls": { "type": "array" } }, "required": ["enabled"] }, "not": { "required": ["enabled"] } } ] }, "httpProxy": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "additionalProperties": true }, "createContourGateway": { "type": "boolean" }, "namespace": { "type": "string" }, "contourResponseTimeout": { "type": ["boolean", "string"] }, "podDisruptionBudget": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "maxUnavailable": { "type": ["string", "integer"] }, "minAvailable": { "type": ["string", "integer"] } }, "additionalProperties": false }, "externalSecret": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "secretName": { "type": "string" }, "path": { "type": "string" }, "version": { "type": "string" }, "refreshInterval": { "type": "string" }, "secretStoreRef": { "type": "string" } }, "additionalProperties": false }, "keda": { "type": "object" }, "resources": { "type": "object", "properties": { "limits": { "type": "object" }, "requests": { "type": "object" } } }, "livenessProbe": { "type": "object" }, "readinessProbe": { "type": "object" }, "autoscaling": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "minReplicas": { "type": "integer", "minimum": 1 }, "maxReplicas": { "type": "integer", "minimum": 1 }, "targetCPUUtilizationPercentage": { "type": "integer", "minimum": 1, "maximum": 100 }, "targetMemoryUtilizationPercentage": { "type": "integer", "minimum": 1, "maximum": 100 } } }, "volumes": { "type": "array" }, "volumeMounts": { "type": "array" }, "nodeSelector": { "type": "object" }, "tolerations": { "type": "array" }, "affinity": { "type": "object" }, "strategy": { "type": "object", "description": "Deployment update strategy. Applies to the Deployment only (not the StatefulSet). Empty uses the Kubernetes default. Rendered verbatim into spec.strategy." }, "bifrost": { "type": "object", "description": "Bifrost application configuration", "properties": { "appDir": { "type": "string", "description": "Application data directory" }, "port": { "type": "integer", "minimum": 1, "maximum": 65535 }, "host": { "type": "string" }, "logLevel": { "type": "string", "enum": ["debug", "info", "warn", "error"] }, "logStyle": { "type": "string", "enum": ["json", "text"] }, "envLabel": { "type": "string", "description": "Short label (max 10 characters) displayed in the management UI sidebar to identify the environment (e.g. \"staging\", \"prod\"). Written into config.json as env_label.", "maxLength": 10 }, "sourceOfTruth": { "type": "string", "enum": ["split", "config.json"], "default": "split", "description": "Controls how config.json is reconciled with the database on startup. \"split\" (default) preserves existing merge behavior. \"config.json\" makes explicitly-present sections in the file authoritative — database-only rows for those sections are pruned on startup." }, "encryptionKey": { "type": "string", "description": "Encryption key for sensitive data. If not set, encryption is disabled and data is stored in plaintext." }, "encryptionKeySecret": { "type": "object", "description": "Reference to an existing Kubernetes secret holding the encryption key. Takes precedence over `encryptionKey` when `name` is set.", "properties": { "name": { "type": "string" }, "key": { "type": "string", "default": "encryption-key" } }, "additionalProperties": false }, "authConfig": { "$ref": "#/$defs/authConfig" }, "client": { "type": "object", "description": "Client configuration settings", "properties": { "dropExcessRequests": { "type": "boolean", "description": "Whether to drop excess requests when pool is full" }, "initialPoolSize": { "type": "integer", "minimum": 1, "description": "Initial size of the connection pool", "default": 300 }, "allowedOrigins": { "type": "array", "items": { "anyOf": [ { "type": "string", "const": "*" }, { "type": "string", "format": "uri" } ] }, "description": "CORS allowed origins (supports \"*\" or URI strings)" }, "enableLogging": { "type": "boolean", "description": "Enable request/response logging" }, "disableContentLogging": { "type": "boolean", "description": "Disable logging of sensitive content (inputs, outputs, embeddings, etc.)" }, "allowPerRequestContentStorageOverride": { "type": "boolean", "description": "Allow individual requests to override content storage via the x-bf-disable-content-logging header or context key, and to opt in to raw-byte persistence in logs via x-bf-store-raw-request-response. When false (default), the global disable_content_logging setting is authoritative and per-request storage overrides are ignored. Does not control sending raw bytes back to callers.", "default": false }, "allowPerRequestRawOverride": { "type": "boolean", "description": "Allow individual requests to send raw provider request/response bytes back to the caller via the x-bf-send-back-raw-request and x-bf-send-back-raw-response headers. When false (default), the provider-level send_back_raw_request/response settings are authoritative and per-request overrides are ignored. Does not affect raw-byte persistence in logs.", "default": false }, "disableDbPingsInHealth": { "type": "boolean", "description": "Disable DB pings in health check", "default": false }, "dumpErrorsInConsoleLogs": { "type": "boolean", "description": "Dump full error details to the server console logs. Useful for debugging; may be noisy in production.", "default": false }, "logRetentionDays": { "type": "integer", "minimum": 1, "description": "Number of days to retain logs", "default": 365 }, "enforceGovernanceHeader": { "type": "boolean", "description": "Deprecated: use enforceAuthOnInference" }, "maxRequestBodySizeMb": { "type": "integer", "minimum": 1, "description": "Maximum request body size in MB" }, "compat": { "type": "object", "description": "Compat plugin configuration for request type conversion, parameter dropping, and parameter value conversion", "properties": { "convertTextToChat": { "type": "boolean", "description": "Convert text completion requests to chat for models that only support chat" }, "convertChatToResponses": { "type": "boolean", "description": "Convert chat completion requests to responses for models that only support responses" }, "shouldDropParams": { "type": "boolean", "description": "Drop unsupported parameters based on model catalog allowlist" }, "shouldConvertParams": { "type": "boolean", "description": "Converts model parameter values that are not supported by the model." } }, "additionalProperties": false }, "prometheusLabels": { "type": "array", "items": { "type": "string" }, "description": "Labels to use for Prometheus metrics" }, "headerFilterConfig": { "type": "object", "description": "Global header filtering configuration for x-bf-eh-* headers forwarded to LLM providers", "properties": { "allowlist": { "type": "array", "items": { "type": "string" }, "description": "If non-empty, only these headers (from x-bf-eh-* prefix) are allowed to be forwarded" }, "denylist": { "type": "array", "items": { "type": "string" }, "description": "Headers to always block from being forwarded" } }, "additionalProperties": false }, "enforceAuthOnInference": { "type": "boolean", "description": "Require auth (VK, API key, or user token) on inference endpoints" }, "enableLitellmFallbacks": { "type": "boolean", "deprecated": true, "description": "Deprecated compatibility key accepted for existing Meesho overrides; ignored by Bifrost 1.5.x" }, "enforceSCIMAuth": { "type": "boolean", "description": "Deprecated: use enforceAuthOnInference" }, "allowedHeaders": { "type": "array", "items": { "type": "string" }, "description": "Additional allowed headers for CORS and WebSocket" }, "mcpAgentDepth": { "type": "integer", "minimum": 1, "description": "DEPRECATED: Maximum depth for MCP agent mode tool execution. Use bifrost.mcp.toolManagerConfig.maxAgentDepth.", "default": 10 }, "mcpToolExecutionTimeout": { "type": "integer", "minimum": 1, "description": "DEPRECATED: Timeout for individual MCP tool execution in seconds. Use bifrost.mcp.toolManagerConfig.toolExecutionTimeout.", "default": 30 }, "mcpCodeModeBindingLevel": { "type": "string", "enum": ["server", "tool"], "description": "DEPRECATED: Code mode binding level for MCP tools. Use bifrost.mcp.toolManagerConfig.codeModeBindingLevel." }, "mcpToolSyncInterval": { "type": "integer", "minimum": 0, "description": "DEPRECATED: Global tool sync interval in minutes (0 = disabled). Use bifrost.mcp.toolSyncInterval." }, "asyncJobResultTTL": { "type": "integer", "description": "Default TTL for async job results in seconds (default: 3600 = 1 hour)", "default": 3600, "minimum": 1 }, "requiredHeaders": { "type": "array", "items": { "type": "string" }, "description": "Headers that must be present on every request. Requests missing any of these headers are rejected with 400. Case-insensitive matching." }, "loggingHeaders": { "type": "array", "items": { "type": "string" }, "description": "Headers to capture in log metadata. Values are extracted from incoming requests and stored in the metadata field of log entries." }, "whitelistedRoutes": { "type": "array", "items": { "type": "string" }, "description": "Routes that bypass auth middleware. Requests to these exact paths skip authentication checks." }, "hideDeletedVirtualKeysInFilters": { "type": "boolean", "description": "When true, deleted virtual keys are omitted from logs and MCP logs filter data.", "default": false }, "mcpDisableAutoToolInject": { "type": "boolean", "description": "DEPRECATED: When true, MCP tools are not automatically injected into requests. Use bifrost.mcp.toolManagerConfig.disableAutoToolInject.", "default": false }, "mcpEnableTempTokenAuth": { "type": "boolean", "description": "When true, Bifrost mints and accepts scoped temp tokens for MCP per-user OAuth auth pages.", "default": false }, "routingChainMaxDepth": { "type": "integer", "minimum": 1, "description": "Maximum depth for routing rule chain evaluation", "default": 10 }, "allowDirectKeys": { "type": "boolean", "description": "Allow callers to bypass the registered key pool by supplying x-bf-direct-key: true with an Authorization header carrying the provider key. Maps to client.allow_direct_keys.", "default": false }, "mcpExternalClientUrl": { "type": "string", "description": "Public base URL Bifrost uses as the redirect_uri when acting as an OAuth client to upstream MCP servers. Maps to client.mcp_external_client_url." }, "mcpServerAuthMode": { "type": "string", "enum": ["headers", "both", "oauth"], "description": "How /mcp authenticates inbound MCP clients. 'headers' (default): VK/api-key/session headers only, discovery disabled. 'both': accepts header credentials and Bifrost-issued JWTs, discovery enabled. 'oauth': Bifrost JWTs only. Maps to client.mcp_server_auth_mode." }, "oauth2ServerConfig": { "type": "object", "description": "OAuth2 authorization server settings for /mcp. Only relevant when mcpServerAuthMode is 'both' or 'oauth'. Maps to client.oauth2_server_config.", "properties": { "issuerUrl": { "type": "string", "description": "Stable public URL advertised as the OAuth2 AS issuer in discovery documents and JWT iss claim. Required for multi-host deployments. Supports env var syntax: \"env.MY_VAR\"." }, "authCodeTtl": { "type": "integer", "minimum": 1, "maximum": 900, "description": "Lifetime of the single-use authorization code in seconds (default: 300, max: 900)." }, "accessTokenTtl": { "type": "integer", "minimum": 1, "description": "Lifetime of the issued JWT Bearer token in seconds (default: 600)." }, "disableVkIdentity": { "type": "boolean", "description": "When true, the OAuth consent flow no longer offers or accepts virtual-key identity. Honored only when an identity provider is configured. Only valid when mcpServerAuthMode is 'oauth'." } }, "additionalProperties": false } }, "additionalProperties": false }, "server": { "type": "object", "description": "HTTP server configuration", "properties": { "readBufferSize": { "type": "integer", "description": "Read buffer size in bytes. This controls the size of the buffer used for reading HTTP headers.", "default": 65536 } }, "additionalProperties": false }, "framework": { "type": "object", "properties": { "pricing": { "type": "object", "properties": { "pricingUrl": { "type": "string", "description": "Custom pricing URL (optional, can be empty)" }, "modelParametersUrl": { "type": "string", "description": "Custom model parameters URL (optional, can be empty)" }, "pricingSyncInterval": { "type": "integer", "description": "Pricing sync interval in seconds. Default is 24 hours. Minimum is 3600 seconds (1 hour).", "default": 86400, "minimum": 3600 }, "mcpLibraryUrl": { "description": "URL to a custom MCP server catalog. Leave empty to use the default Bifrost catalog.", "anyOf": [ {"type": "string", "format": "uri"}, {"const": ""} ] }, "mcpLibrarySyncInterval": { "type": "integer", "description": "MCP library sync interval in seconds. Default is 24 hours. Minimum is 3600 seconds (1 hour).", "default": 86400, "minimum": 3600 } }, "additionalProperties": false } }, "additionalProperties": false }, "providers": { "type": "object", "description": "AI provider configurations", "additionalProperties": { "$ref": "#/$defs/provider" } }, "providerSecrets": { "type": "object", "additionalProperties": { "type": "object", "properties": { "existingSecret": { "type": "string" }, "key": { "type": "string" }, "envVar": { "type": "string" } } } }, "mcp": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "clientConfigs": { "type": "array", "items": { "$ref": "#/$defs/mcpClientConfig" }, "description": "MCP client configurations" }, "toolManagerConfig": { "type": "object", "properties": { "toolExecutionTimeout": { "type": ["integer", "string"], "description": "Tool execution timeout. Integer = seconds (e.g. 30), string = Go duration (e.g. \"30s\", \"2m\"). Prefer the string form.", "default": "30s" }, "maxAgentDepth": { "type": "integer", "description": "Max agent depth", "minimum": 1, "default": 10 }, "codeModeBindingLevel": { "type": "string", "enum": ["server", "tool"], "description": "How tools are exposed in VFS for code execution" }, "disableAutoToolInject": { "type": "boolean", "description": "When true, MCP tools are not automatically injected into requests. Tools are only included when explicitly specified via request context filters or headers, such as x-bf-mcp-include-tools or x-bf-mcp-include-clients.", "default": false } } }, "toolSyncInterval": { "description": "Global default interval for syncing tools from MCP servers (Go duration string, e.g. '10m', '1h', '0s' to use runtime default). Legacy numeric nanoseconds are also supported for backward compatibility.", "oneOf": [ { "type": "string", "pattern": "^-?(?:\\d+(?:\\.\\d+)?(?:ns|us|\u00b5s|ms|s|m|h))+$" }, { "type": "integer" } ] }, "toolGroups": { "type": "array", "description": "Enterprise MCP tool groups with optional governance associations", "items": { "$ref": "#/$defs/mcpToolGroupConfig" } } }, "additionalProperties": false, "description": "Model Context Protocol configuration" }, "plugins": { "type": "object", "properties": { "telemetry": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "config": { "type": "object", "properties": { "custom_labels": { "type": "array", "items": { "type": "string" }, "description": "Custom labels to add to all metrics" }, "push_gateway": { "type": "object", "description": "Configuration for pushing metrics to a Prometheus Push Gateway for multi-node cluster deployments", "properties": { "enabled": { "type": "boolean", "description": "Whether to enable pushing metrics to the Push Gateway", "default": false }, "push_gateway_url": { "type": "string", "description": "URL of the Prometheus Push Gateway (e.g., http://pushgateway:9091)", "format": "uri" }, "job_name": { "type": "string", "description": "Job label for pushed metrics", "default": "bifrost" }, "instance_id": { "type": "string", "description": "Instance identifier for grouping metrics. If not set, hostname is used automatically." }, "push_interval": { "type": "integer", "description": "How often to push metrics in seconds", "default": 15, "minimum": 1, "maximum": 300 }, "basic_auth": { "type": "object", "description": "Basic authentication credentials for the Push Gateway", "properties": { "username": { "type": "string", "description": "Username for basic authentication" }, "password": { "type": "string", "description": "Password for basic authentication" } }, "required": ["username", "password"] } }, "required": ["push_gateway_url"] } } } } }, "logging": { "$ref": "#/$defs/pluginBase" }, "governance": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "config": { "type": "object", "properties": { "is_vk_mandatory": { "type": "boolean" }, "required_headers": { "type": "array", "items": { "type": "string" }, "description": "Headers that must be present in requests" }, "is_enterprise": { "type": "boolean", "description": "Enable enterprise mode features" } } } } }, "maxim": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "config": { "type": "object", "properties": { "api_key": { "type": "string" }, "log_repo_id": { "type": "string" } } }, "secretRef": { "type": "object", "properties": { "name": { "type": "string" }, "key": { "type": "string" } } } }, "if": { "properties": { "enabled": { "const": true } } }, "then": { "anyOf": [ { "properties": { "config": { "required": ["api_key"] } } }, { "properties": { "secretRef": { "required": ["name"] } } } ] } }, "semanticCache": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "config": { "type": "object", "properties": { "provider": { "type": "string", "enum": [ "openai", "anthropic", "gemini", "bedrock", "azure", "cohere", "mistral", "groq", "ollama", "openrouter", "vertex", "cerebras", "deepseek", "parasail", "perplexity", "sgl", "huggingface" ] }, "keys": { "type": "array", "items": { "type": "string" }, "description": "API keys for embedding provider (required for semantic caching, not needed for direct caching with dimension: 1)" }, "embedding_model": { "type": "string" }, "dimension": { "type": "integer", "minimum": 1 }, "threshold": { "type": "number", "minimum": 0, "maximum": 1 }, "ttl": { "description": "Time-to-live for cached responses (supports duration strings like '5m', '1h' or seconds as number, default: 5min)", "oneOf": [ { "type": "string", "pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$" }, { "type": "integer", "minimum": 0 } ] }, "conversation_history_threshold": { "type": "integer", "minimum": 0 }, "cache_by_model": { "type": "boolean" }, "cache_by_provider": { "type": "boolean" }, "exclude_system_prompt": { "type": "boolean" }, "vector_store_namespace": { "type": "string" }, "default_cache_key": { "type": "string", "description": "Default cache key for semantic cache lookups" } } } }, "if": { "properties": { "enabled": { "const": true } } }, "then": { "properties": { "config": { "required": ["dimension"] } } } }, "otel": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "config": { "anyOf": [ { "$ref": "#/$defs/otelProfileConfig" }, { "$ref": "#/$defs/otelProfilesConfig" } ], "description": "Configuration for the OpenTelemetry plugin. Supports the legacy single-profile shape or the profiles wrapper for multiple collectors." } }, "if": { "properties": { "enabled": { "const": true } } }, "then": { "properties": { "config": { "anyOf": [ { "$ref": "#/$defs/otelProfileConfig" }, { "$ref": "#/$defs/otelProfilesConfig" } ] } } } }, "datadog": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "version": { "type": "integer", "minimum": 1 }, "config": { "type": "object", "properties": { "service_name": { "type": "string" }, "ml_app": { "type": "string", "description": "ML application name for Datadog LLM Observability grouping (defaults to service_name)" }, "agent_addr": { "type": "string", "description": "Datadog Agent address for APM traces as combined host:port (agent mode only). Supports env.VAR_NAME prefix for environment variable substitution (e.g. env.DD_AGENT_ADDR). Overridden by agent_host when set" }, "agent_host": { "type": "string", "description": "Datadog Agent host for APM traces, set separately from the port (agent mode only). Supports env.VAR_NAME prefix (e.g. env.DD_AGENT_HOST). Takes precedence over agent_addr. Useful in Kubernetes where the host is injected via the downward API (status.hostIP)" }, "agent_port": { "type": "string", "description": "Datadog Agent port for APM traces, used with agent_host (agent mode only). Supports env.VAR_NAME prefix. Defaults to 8126; has no effect when agent_host is unset" }, "dogstatsd_addr": { "type": "string", "description": "DogStatsD server address for metrics as combined host:port (agent mode only). Supports env.VAR_NAME prefix for environment variable substitution (e.g. env.DD_DOGSTATSD_ADDR). Overridden by dogstatsd_host when set" }, "dogstatsd_host": { "type": "string", "description": "DogStatsD server host for metrics, set separately from the port (agent mode only). Supports env.VAR_NAME prefix (e.g. env.DD_DOGSTATSD_HOST). Takes precedence over dogstatsd_addr. Useful in Kubernetes where the host is injected via the downward API (status.hostIP)" }, "dogstatsd_port": { "type": "string", "description": "DogStatsD server port for metrics, used with dogstatsd_host (agent mode only). Supports env.VAR_NAME prefix. Defaults to 8125; has no effect when dogstatsd_host is unset" }, "env": { "type": "string" }, "version": { "type": "string" }, "custom_tags": { "type": "object", "description": "Custom tags for Datadog metrics and traces. Values support env.VAR_NAME prefix for environment variable substitution", "additionalProperties": { "type": "string" } }, "enable_metrics": { "type": "boolean", "description": "Enable Datadog metrics emission (default: true)" }, "enable_traces": { "type": "boolean", "description": "Enable Datadog APM traces (default: true)" }, "enable_llm_obs": { "type": "boolean", "description": "Enable Datadog LLM Observability (default: true)" }, "group_traces_by_session": { "type": "boolean", "description": "Group requests sharing the same x-bf-session-id header into a single APM trace, with each request as a top-level sibling span. Agent mode only; an inbound W3C traceparent takes precedence (default: false)" }, "disable_content_logging": { "type": "boolean", "description": "When true, sensitive content (prompts, completions, embeddings) is excluded from traces (default: false)" }, "agentless": { "type": "boolean", "description": "Use agentless mode to send data directly to Datadog APIs instead of a local agent. Requires api_key (default: false)" }, "api_key": { "type": "string", "description": "Datadog API key, required for agentless mode. Supports env.VAR_NAME prefix for environment variable substitution (e.g. env.DD_API_KEY)" }, "site": { "type": "string", "description": "Datadog site/region for agentless mode (e.g. datadoghq.com, datadoghq.eu)" }, "request_headers": { "type": "array", "items": { "type": "string" }, "description": "Request header names to capture as Datadog span tags" }, "plugin_span_filter": { "$ref": "#/$defs/pluginSpanFilter" } } } } }, "bigquery": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "version": { "type": "integer", "minimum": 1 }, "config": { "type": "object", "properties": { "project_id": { "type": "string" }, "dataset_id": { "type": "string" }, "table_id": { "type": "string" }, "location": { "type": "string" }, "service_account_key": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "value": { "type": "string" }, "env_var": { "type": "string" }, "from_env": { "type": "boolean" } }, "additionalProperties": false } ] }, "create_table_if_not_exists": { "type": "boolean" }, "flush_interval_seconds": { "type": "integer" }, "buffer_size": { "type": "integer" }, "custom_labels": { "type": "object" }, "disable_content_logging": { "type": "boolean" }, "request_headers": { "type": "array", "items": { "type": "string" } }, "plugin_span_filter": { "$ref": "#/$defs/pluginSpanFilter" } }, "required": ["project_id"] } } }, "kafka": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "version": { "type": "integer", "minimum": 1 }, "config": { "type": "object", "properties": { "brokers": { "type": "array", "items": { "type": "string" }, "description": "Kafka broker addresses (required when enabled)" }, "topic": { "type": "string", "description": "Kafka topic to publish traces to (required when enabled)" }, "sasl_enabled": { "type": "boolean", "description": "Enable SASL authentication. SASL is only activated when both sasl_enabled is true and sasl is set" }, "sasl": { "type": "object", "properties": { "mechanism": { "type": "string", "enum": ["PLAIN", "SCRAM-SHA-256", "SCRAM-SHA-512"] }, "username": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "value": { "type": "string" }, "env_var": { "type": "string" }, "from_env": { "type": "boolean" } }, "additionalProperties": false } ], "description": "SASL username. Supports env.VAR_NAME prefix for environment variable substitution" }, "password": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "value": { "type": "string" }, "env_var": { "type": "string" }, "from_env": { "type": "boolean" } }, "additionalProperties": false } ], "description": "SASL password. Supports env.VAR_NAME prefix for environment variable substitution" } }, "additionalProperties": false }, "tls_enabled": { "type": "boolean", "description": "Enable TLS for broker connections" }, "ca_cert": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "value": { "type": "string" }, "env_var": { "type": "string" }, "from_env": { "type": "boolean" } }, "additionalProperties": false } ], "description": "PEM-encoded CA certificate used to verify the broker's TLS certificate. Omit to use the system CA pool. Supports env.VAR_NAME prefix" }, "compression": { "type": "string", "enum": ["none", "gzip", "snappy", "lz4", "zstd"], "description": "Compression codec for published messages" }, "batch_size": { "type": "integer", "description": "Maximum number of messages batched per write (default: 100)" }, "flush_interval_ms": { "type": "integer", "description": "Maximum time (ms) to wait before flushing a batch (default: 1000)" }, "auto_create_topic": { "type": "boolean", "description": "Create the topic at startup if it does not exist" }, "disable_content_logging": { "type": "boolean", "description": "Strip input/output message content from traces before publishing" }, "request_headers": { "type": "array", "items": { "type": "string" }, "description": "Request-header name patterns (exact or wildcard like \"x-custom-*\") whose captured values are embedded in published traces" }, "plugin_span_filter": { "$ref": "#/$defs/pluginSpanFilter" } } } }, "if": { "properties": { "enabled": { "const": true } }, "required": ["enabled"] }, "then": { "required": ["config"], "properties": { "config": { "required": ["brokers", "topic"], "properties": { "brokers": { "minItems": 1 } } } } } }, "pubsub": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "version": { "type": "integer", "minimum": 1 }, "config": { "type": "object", "properties": { "project_id": { "type": "string", "description": "GCP project ID (required when enabled)" }, "topic_id": { "type": "string", "description": "Pub/Sub topic ID — just the ID, not the full resource name (required when enabled)" }, "service_account_key": { "anyOf": [ { "type": "string" }, { "type": "object", "properties": { "value": { "type": "string" }, "env_var": { "type": "string" }, "from_env": { "type": "boolean" } }, "additionalProperties": false } ], "description": "Service account key JSON for authentication. Omit to use Application Default Credentials (ADC). Supports env.VAR_NAME prefix" }, "auto_create_topic": { "type": "boolean", "description": "Create the topic at startup if it does not exist" }, "disable_content_logging": { "type": "boolean", "description": "Strip request/response content from traces before publishing" }, "request_headers": { "type": "array", "items": { "type": "string" }, "description": "Request-header name patterns (exact or wildcard like \"x-custom-*\") whose captured values are included in published traces" }, "plugin_span_filter": { "$ref": "#/$defs/pluginSpanFilter" } } } }, "if": { "properties": { "enabled": { "const": true } }, "required": ["enabled"] }, "then": { "required": ["config"], "properties": { "config": { "required": ["project_id", "topic_id"] } } } }, "custom": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "enabled": { "type": "boolean" }, "path": { "type": "string" }, "version": { "type": "integer", "minimum": 1 }, "config": { "type": "object" }, "placement": { "type": "string", "enum": ["pre_builtin", "post_builtin", "builtin"], "default": "post_builtin", "description": "Plugin execution placement relative to built-in plugins" }, "order": { "type": "integer", "default": 0, "description": "Position within placement group. Lower = earlier execution" } }, "required": ["name", "enabled"] } } } }, "governance": { "type": "object", "properties": { "budgets": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "max_limit": { "type": "number" }, "reset_duration": { "type": "string" }, "virtual_key_id": { "type": "string", "description": "Associate this budget to a virtual key (mutually exclusive with provider_config_id and team_id)" }, "provider_config_id": { "type": "integer", "description": "Associate this budget to a virtual key provider config (mutually exclusive with virtual_key_id and team_id)" }, "model_config_id": { "type": "string", "description": "Associate this budget to a model config (mutually exclusive with the other owner IDs)" }, "customer_id": { "type": "string", "description": "Associate this budget to a customer (mutually exclusive with the other owner IDs)" }, "team_id": { "type": "string", "description": "Associate this budget to a team (mutually exclusive with virtual_key_id and provider_config_id)" }, "calendar_aligned": { "type": "boolean", "description": "Snap budget reset windows to calendar boundaries", "default": false }, "current_usage": { "type": "number" }, "last_reset": { "type": "string", "format": "date-time" } }, "allOf": [ { "not": { "required": ["virtual_key_id", "provider_config_id"] } }, { "not": { "required": ["virtual_key_id", "team_id"] } }, { "not": { "required": ["provider_config_id", "team_id"] } } ], "required": ["id", "max_limit", "reset_duration"] } }, "rateLimits": { "type": "array", "description": "Rate limit configurations", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Rate limit ID" }, "token_max_limit": { "type": "integer", "description": "Maximum tokens allowed" }, "token_reset_duration": { "type": "string", "description": "Token reset duration (e.g., '30s', '5m', '1h', '1d', '1w', '1M', '1Y')" }, "token_current_usage": { "type": "integer", "description": "Current token usage", "default": 0 }, "token_last_reset": { "type": "string", "format": "date-time", "description": "Last time token counter was reset" }, "request_max_limit": { "type": "integer", "description": "Maximum requests allowed" }, "request_reset_duration": { "type": "string", "description": "Request reset duration (e.g., '30s', '5m', '1h', '1d', '1w', '1M', '1Y')" }, "request_current_usage": { "type": "integer", "description": "Current request usage", "default": 0 }, "request_last_reset": { "type": "string", "format": "date-time", "description": "Last time request counter was reset" } }, "required": ["id"], "additionalProperties": false } }, "customers": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "budget_id": { "type": "string" }, "rate_limit_id": { "type": "string" } }, "required": ["id", "name"] } }, "teams": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "customer_id": { "type": "string" }, "budget_id": { "type": "string" }, "rate_limit_id": { "type": "string" }, "business_unit_id": { "type": "string" }, "profile": { "type": "object" }, "config": { "type": "object" }, "claims": { "type": "object" } }, "required": ["id", "name"] } }, "businessUnits": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "budget_id": { "type": "string" }, "rate_limit_id": { "type": "string" }, "profile": { "type": "object" }, "config": { "type": "object" }, "claims": { "type": "object" }, "teamIds": { "type": "array", "items": { "type": "string" } } }, "required": ["id", "name"] } }, "roles": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "description": { "type": "string" }, "dac": { "type": "string", "enum": ["own-data", "team-data", "all-data"], "default": "all-data" }, "access_profile": { "type": "string" }, "permissions": { "type": "array", "items": { "type": "object", "properties": { "resource": { "type": "string" }, "operation": { "type": "string" } }, "required": ["resource", "operation"], "additionalProperties": false } } }, "required": ["name"], "additionalProperties": false } }, "virtualKeys": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "description": { "type": "string" }, "value": { "type": "string" }, "is_active": { "type": "boolean" }, "expires_at": { "type": "string", "format": "date-time", "description": "Optional expiry timestamp (RFC3339). Once passed, requests using this virtual key are rejected. Omit for a key that never expires." }, "team_id": { "type": "string" }, "customer_id": { "type": "string" }, "access_profile_id": { "type": "integer", "minimum": 1 }, "rate_limit_id": { "type": "string" }, "calendar_aligned": { "type": "boolean" }, "provider_configs": { "type": "array", "items": { "$ref": "#/$defs/virtualKeyProviderConfig" } }, "mcp_configs": { "type": "array", "items": { "type": "object", "properties": { "mcp_client_id": { "type": "integer" }, "mcp_client_name": { "type": "string" }, "tools_to_execute": { "type": "array", "items": { "type": "string" } } } } } }, "required": ["id", "name"] } }, "routingRules": { "type": "array", "description": "Routing rules for dynamic provider/model selection based on CEL expressions", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "description": { "type": "string" }, "enabled": { "type": "boolean", "default": true }, "cel_expression": { "type": "string" }, "targets": { "type": "array", "minItems": 1, "description": "Weighted routing targets. Weights must sum to 1.", "items": { "type": "object", "properties": { "provider": { "type": "string", "description": "Target provider name" }, "model": { "type": "string", "description": "Target model name" }, "provider_key_name": { "type": "string", "description": "Optional provider key name. Resolved to internal key_id at config load time." }, "weight": { "type": "number", "description": "Probability weight for this target (must be > 0, all weights must sum to 1)", "exclusiveMinimum": 0, "maximum": 1 } }, "required": ["weight"] } }, "fallbacks": { "type": "array", "items": { "type": "string" } }, "scope": { "type": "string", "enum": ["global", "team", "customer", "virtual_key"], "default": "global" }, "scope_id": { "type": ["string", "null"] }, "priority": { "type": "integer", "default": 0 }, "query": { "description": "Visual rule builder state for the management UI (react-querybuilder). Omitted unless exported from the dashboard. Not evaluated at routing runtime (cel_expression is). When present, must include combinator and rules[].", "anyOf": [ { "type": "null" }, { "type": "object", "required": ["combinator", "rules"], "properties": { "combinator": { "type": "string", "enum": ["and", "or"] }, "rules": { "type": "array", "description": "Leaf rules (field, operator, value) and/or nested combinator+rules groups from the query builder." } }, "additionalProperties": true } ] } }, "required": ["id", "name", "targets"] } }, "authConfig": { "$ref": "#/$defs/authConfig" }, "modelConfigs": { "type": "array", "description": "Per-model rate limit and budget configurations", "items": { "type": "object", "properties": { "id": { "type": "string" }, "model_name": { "type": "string", "description": "Model name, or \"*\" to match all models" }, "provider": { "type": "string", "description": "Provider name; omit to apply to all providers" }, "scope": { "type": "string", "enum": ["global", "virtual_key"], "default": "global", "description": "Scope where this limit applies" }, "scope_id": { "type": "string", "description": "Target entity ID — required when scope is \"virtual_key\"" }, "calendar_aligned": { "type": "boolean", "description": "Snap this config's budget reset windows to calendar boundaries rather than rolling windows; virtual_key-scoped configs inherit the virtual key's setting", "default": false }, "budget_id": { "type": "string" }, "rate_limit_id": { "type": "string" } }, "required": ["id", "model_name"] } }, "providers": { "type": "array", "description": "Provider-level governance configurations", "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Provider name" }, "budget_id": { "type": "string" }, "rate_limit_id": { "type": "string" }, "send_back_raw_request": { "type": "boolean" }, "send_back_raw_response": { "type": "boolean" }, "store_raw_request_response": { "type": "boolean" } }, "required": ["name"] } }, "pricingOverrides": { "type": "array", "description": "Scoped pricing overrides applied at runtime by the model catalog", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique pricing override ID" }, "name": { "type": "string", "description": "Human-readable name for this override" }, "scope_kind": { "type": "string", "enum": [ "global", "provider", "provider_key", "virtual_key", "virtual_key_provider", "virtual_key_provider_key" ], "description": "Scope level for this override" }, "virtual_key_id": { "type": "string", "description": "Virtual key ID (required for virtual_key* scopes)" }, "provider_id": { "type": "string", "description": "Provider name (required for provider* scopes; field key remains provider_id for compatibility)" }, "provider_key_name": { "type": "string", "description": "Provider key name alias. Resolved to internal provider key ID at config load time." }, "match_type": { "type": "string", "enum": ["exact", "wildcard"], "description": "How the pattern is matched against model names" }, "pattern": { "type": "string", "description": "Model name pattern to match" }, "request_types": { "type": "array", "minItems": 1, "items": { "type": "string" }, "description": "Request types this override applies to" }, "pricing_patch": { "type": "string", "description": "JSON-encoded pricing fields to override" }, "config_hash": { "type": "string", "description": "Internal hash for change detection (auto-managed)" } }, "required": ["id", "name", "scope_kind", "match_type", "pattern", "request_types"] } }, "complexityAnalyzerConfig": { "type": ["object", "null"], "description": "Runtime configuration for complexity_tier CEL routing. Renders into governance.complexity_analyzer_config in config.json.", "properties": { "tier_boundaries": { "type": "object", "properties": { "simple_medium": { "type": "number", "exclusiveMinimum": 0, "exclusiveMaximum": 1 }, "medium_complex": { "type": "number", "exclusiveMinimum": 0, "exclusiveMaximum": 1 }, "complex_reasoning": { "type": "number", "exclusiveMinimum": 0, "exclusiveMaximum": 1 } }, "required": ["simple_medium", "medium_complex", "complex_reasoning"], "additionalProperties": false }, "keywords": { "type": "object", "properties": { "code_keywords": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "reasoning_keywords": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "technical_keywords": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "simple_keywords": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 } }, "required": ["code_keywords", "reasoning_keywords", "technical_keywords", "simple_keywords"], "additionalProperties": false } }, "required": ["tier_boundaries", "keywords"], "additionalProperties": false } }, "additionalProperties": false }, "cluster": { "type": "object", "description": "Cluster mode configuration", "properties": { "enabled": { "type": "boolean", "description": "Whether cluster mode is enabled" }, "peers": { "type": "array", "description": "List of peer addresses", "items": { "type": "string", "description": "Peer address in host:port format" } }, "region": { "type": "string", "description": "Region label for cluster deployment (runtime default: unknown)" }, "gossip": { "type": "object", "description": "Gossip protocol configuration", "properties": { "port": { "type": "integer", "minimum": 1, "maximum": 65535, "description": "Port for gossip communication" }, "config": { "type": "object", "description": "Gossip protocol settings", "properties": { "timeoutSeconds": { "type": "integer", "minimum": 1, "description": "Timeout for operations in seconds" }, "successThreshold": { "type": "integer", "minimum": 1, "description": "Number of successful probes required" }, "failureThreshold": { "type": "integer", "minimum": 1, "description": "Number of failed probes before marking as failed" } }, "required": ["timeoutSeconds", "successThreshold", "failureThreshold"], "additionalProperties": false } }, "required": ["port", "config"], "additionalProperties": false }, "grpc": { "type": "object", "description": "gRPC transport settings for cluster counter-sync. Replaces gossip broadcast for governance counters; memberlist still handles membership.", "properties": { "port": { "type": "integer", "minimum": 1, "maximum": 65535, "description": "TCP port for the cluster gRPC server" }, "dialTimeoutSeconds": { "type": "integer", "minimum": 1, "description": "Timeout when dialing peers, in seconds" } } }, "discovery": { "type": "object", "description": "Auto-discovery configuration for cluster nodes", "properties": { "enabled": { "type": "boolean", "description": "Whether auto-discovery is enabled" }, "type": { "type": "string", "enum": ["", "kubernetes", "dns", "udp", "consul", "etcd", "mdns"], "description": "Discovery type (empty when not configured)" }, "serviceName": { "type": "string", "description": "Service name for discovery backends (required for consul/etcd/udp; used as default for mdns)" }, "bindPort": { "type": "integer", "minimum": 1, "maximum": 65535, "description": "Port to bind for cluster communication" }, "dialTimeout": { "type": "string", "description": "Timeout for discovery dial operations as a Go duration string (e.g. '5s', '1m')" }, "allowedAddressSpace": { "type": "array", "items": { "type": "string" }, "description": "CIDR notation for allowed address spaces (e.g., ['10.0.0.0/8', '192.168.0.0/16'])" }, "k8sNamespace": { "type": "string", "description": "Kubernetes namespace for service discovery" }, "k8sLabelSelector": { "type": "string", "description": "Kubernetes label selector for filtering pods" }, "dnsNames": { "type": "array", "items": { "type": "string" }, "description": "DNS names to resolve for node discovery. Supports env.VAR_NAME for environment variable substitution." }, "udpBroadcastPort": { "type": "integer", "minimum": 0, "maximum": 65535, "description": "UDP broadcast port (0 means not configured)" }, "consulAddress": { "type": "string", "description": "Consul server address for service discovery" }, "etcdEndpoints": { "type": "array", "items": { "type": "string" }, "description": "Etcd endpoints for service discovery" }, "mdnsService": { "type": "string", "description": "mDNS service name for local network discovery" } }, "allOf": [ { "if": { "properties": { "type": { "const": "udp" } } }, "then": { "required": ["udpBroadcastPort", "allowedAddressSpace"] } } ], "if": { "properties": { "enabled": { "const": true } } }, "then": { "required": ["type"] } } }, "if": { "properties": { "enabled": { "const": true } } }, "then": { "required": ["gossip"] } }, "scim": { "type": "object", "description": "SAML/SCIM (System for Cross-domain Identity Management) configuration", "properties": { "enabled": { "type": "boolean", "description": "Whether SAML/SCIM authentication is enabled" }, "provider": { "type": "string", "enum": ["", "okta", "entra", "keycloak", "zitadel", "google", "sailpoint", "generic"], "description": "SCIM/SSO provider type (empty when not configured)" }, "config": { "type": "object", "description": "Provider-specific configuration" } }, "required": ["enabled"], "additionalProperties": false, "allOf": [ { "if": { "properties": { "enabled": { "const": true } }, "required": ["enabled"] }, "then": { "properties": { "provider": { "enum": ["okta", "entra", "keycloak", "zitadel", "google", "sailpoint", "generic"] } }, "required": ["provider"] } }, { "if": { "properties": { "enabled": { "const": true }, "provider": { "const": "okta" } }, "required": ["enabled", "provider"] }, "then": { "properties": { "config": { "type": "object", "description": "Okta JWT authentication configuration", "properties": { "issuerUrl": { "type": "string", "format": "uri", "description": "Okta issuer URL (e.g., https://your-domain.okta.com/oauth2/default)" }, "authServerType": { "type": "string", "enum": ["org", "custom"], "description": "'org' for Org Authorization Server or 'custom' for Custom Authorization Server. Auto-detected from issuer URL when omitted." }, "clientId": { "type": "string", "description": "Okta application client ID" }, "clientSecret": { "type": "string", "description": "Okta client secret" }, "apiToken": { "type": "string", "description": "Okta API token for Admin API access" }, "audience": { "type": "string", "description": "JWT audience for validation (optional)" }, "userIdField": { "type": "string", "description": "JWT claim field for user ID (default: 'sub')", "default": "sub" }, "teamIdsField": { "type": "string", "description": "JWT claim field for team IDs (default: 'groups')", "default": "groups" }, "rolesField": { "type": "string", "description": "JWT claim field for roles (default: 'roles')", "default": "roles" }, "attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"}, "attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"}, "attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"}, "claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"} }, "required": ["issuerUrl", "clientId", "clientSecret", "apiToken"], "additionalProperties": false } } } }, { "if": { "properties": { "enabled": { "const": true }, "provider": { "const": "entra" } }, "required": ["enabled", "provider"] }, "then": { "properties": { "config": { "type": "object", "description": "Microsoft Entra ID (formerly Azure AD) JWT authentication configuration", "properties": { "tenantId": { "type": "string", "description": "Azure tenant ID or 'common' for multi-tenant applications" }, "clientId": { "type": "string", "description": "Application (client) ID from Azure portal" }, "clientSecret": { "type": "string", "description": "Client secret (optional, required for token revocation)" }, "cloud": { "type": "string", "enum": ["commercial", "gcc-high", "dod"], "default": "commercial", "description": "Cloud environment: 'commercial' (default), 'gcc-high' for US Government GCC High, or 'dod' for Department of Defense" }, "audience": { "type": "string", "description": "JWT audience for validation (default: clientId)" }, "appIdUri": { "type": "string", "format": "uri", "description": "App ID URI for v1.0 tokens (e.g., api://{clientId})" }, "userIdField": { "type": "string", "description": "JWT claim field for user ID (default: 'oid')", "default": "oid" }, "teamIdsField": { "type": "string", "description": "JWT claim field for team IDs (default: 'groups')", "default": "groups" }, "rolesField": { "type": "string", "description": "JWT claim field for roles (default: 'roles')", "default": "roles" }, "attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"}, "attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"}, "attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"}, "claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"} }, "required": ["tenantId", "clientId"], "additionalProperties": false } } } }, { "if": { "properties": { "enabled": { "const": true }, "provider": { "const": "keycloak" } }, "required": ["enabled", "provider"] }, "then": { "properties": { "config": { "type": "object", "description": "Keycloak OIDC/SCIM authentication configuration", "properties": { "serverUrl": { "type": "string", "format": "uri", "description": "Base URL of the Keycloak server (e.g., https://keycloak.company.com). Must NOT include the /realms/{realm} suffix." }, "realm": { "type": "string", "description": "Keycloak realm name (e.g., 'bifrost-prod')" }, "clientId": { "type": "string", "description": "Keycloak client ID for the confidential client used by Bifrost" }, "clientSecret": { "type": "string", "description": "Keycloak client secret. Supports env. prefix for environment variable references (e.g., 'env.KEYCLOAK_CLIENT_SECRET')" }, "audience": { "type": "string", "description": "Expected JWT audience (default: clientId)" }, "userIdField": { "type": "string", "description": "JWT claim field for user ID (default: 'sub')", "default": "sub" }, "teamIdsField": { "type": "string", "description": "JWT claim field for team IDs (default: 'groups')", "default": "groups" }, "rolesField": { "type": "string", "description": "JWT claim field for roles (default: 'roles')", "default": "roles" }, "attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"}, "attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"}, "attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"}, "claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"} }, "required": ["serverUrl", "realm", "clientId", "clientSecret"], "additionalProperties": false } } } }, { "if": { "properties": { "enabled": { "const": true }, "provider": { "const": "zitadel" } }, "required": ["enabled", "provider"] }, "then": { "properties": { "config": { "type": "object", "description": "Zitadel OIDC authentication configuration", "properties": { "domain": { "type": "string", "format": "hostname", "pattern": "^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$", "description": "Zitadel instance domain (e.g., 'my-instance.zitadel.cloud' or 'auth.company.com'). Bare host only - do NOT include the scheme, port, or path." }, "clientId": { "type": "string", "description": "Zitadel application client ID" }, "clientSecret": { "type": "string", "description": "Zitadel client secret (optional, required for confidential clients and token revocation)" }, "projectId": { "type": "string", "description": "Optional Zitadel project ID for project-scoped role claims" }, "audience": { "type": "string", "description": "Access-token audience override (default: clientId)" }, "serviceAccountClientId": { "type": "string", "description": "Service account client ID for Zitadel Management API (required for user provisioning - web apps cannot use client_credentials)" }, "serviceAccountClientSecret": { "type": "string", "description": "Service account client secret for Zitadel Management API" }, "teamIdsField": { "type": "string", "description": "JWT claim field for team/group IDs (default: 'groups')", "default": "groups" }, "attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"}, "attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"}, "attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"}, "claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"} }, "required": ["domain", "clientId"], "additionalProperties": false } } } }, { "if": { "properties": { "enabled": { "const": true }, "provider": { "const": "google" } }, "required": ["enabled", "provider"] }, "then": { "properties": { "config": { "type": "object", "description": "Google Workspace OIDC authentication configuration", "properties": { "domain": { "type": "string", "format": "hostname", "pattern": "^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$", "description": "Google Workspace primary domain (e.g., 'company.com'). Bare host only - do NOT include the scheme, port, or path." }, "clientId": { "type": "string", "description": "Google OAuth2 client ID" }, "clientSecret": { "type": "string", "description": "Google client secret (optional, used for token revocation)" }, "credentialMode": { "type": "string", "enum": ["", "inherit", "env", "file"], "description": "How Directory API credentials are sourced. 'inherit' uses Application Default Credentials; 'env' uses serviceAccountEnvVar; 'file' uses serviceAccountFile." }, "serviceAccountEnvVar": { "type": "string", "description": "Name of the environment variable containing the service account JSON (used when credentialMode is 'env'). Required for Directory API access without ADC." }, "serviceAccountFile": { "type": "string", "description": "Filesystem path to the service account JSON key file (used when credentialMode is 'file')." }, "adminEmail": { "type": "string", "format": "email", "description": "Admin email for domain-wide delegation. Required whenever Directory API access is configured." }, "impersonateServiceAccount": { "type": "string", "description": "GCP service account email to impersonate when using ADC (Workload Identity); must have domain-wide delegation configured." }, "audience": { "type": "string", "description": "JWT audience override (default: clientId)" }, "teamIdsField": { "type": "string", "description": "Claim field for team/group IDs (default: 'groups')", "default": "groups" }, "attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"}, "attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"}, "attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"}, "claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"} }, "required": ["domain", "clientId"], "additionalProperties": false, "allOf": [ { "if": { "properties": { "credentialMode": { "const": "env" } }, "required": ["credentialMode"] }, "then": { "required": ["serviceAccountEnvVar"] } }, { "if": { "properties": { "credentialMode": { "const": "file" } }, "required": ["credentialMode"] }, "then": { "required": ["serviceAccountFile"] } }, { "if": { "properties": { "credentialMode": { "enum": ["inherit", "env", "file"] } }, "required": ["credentialMode"] }, "then": { "required": ["adminEmail"] } } ] } } } }, { "if": { "properties": { "enabled": { "const": true }, "provider": { "const": "sailpoint" } }, "required": ["enabled", "provider"] }, "then": { "properties": { "config": { "type": "object", "description": "SailPoint identity security platform configuration", "properties": { "product": { "type": "string", "enum": ["isc", "iiq"], "description": "SailPoint product type: 'isc' for Identity Security Cloud, 'iiq' for IdentityIQ" }, "tenant": { "type": "string", "description": "ISC tenant identifier (required for ISC product)" }, "baseUrl": { "type": "string", "format": "uri", "description": "IdentityIQ base URL (required for IIQ product)" }, "username": { "type": "string", "description": "Username for IdentityIQ authentication" }, "password": { "type": "string", "description": "Password for IdentityIQ authentication" }, "clientId": { "type": "string", "description": "OAuth2 client ID" }, "clientSecret": { "type": "string", "description": "OAuth2 client secret" }, "teamIdsField": { "type": "string", "description": "JWT claim field for team IDs" }, "attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"}, "attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"}, "attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"}, "claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"} }, "required": ["product"], "additionalProperties": false } } } }, { "if": { "properties": { "enabled": { "const": true }, "provider": { "const": "generic" } }, "required": ["enabled", "provider"] }, "then": { "properties": { "config": { "type": "object", "description": "Generic OIDC authentication configuration", "properties": { "issuerUrl": { "type": "string", "format": "uri", "description": "OIDC issuer URL" }, "clientId": { "type": "string", "description": "OAuth2 client ID" }, "clientSecret": { "type": "string", "description": "OAuth2 client secret" }, "audience": { "type": "string", "description": "JWT audience for validation" }, "authorizationEndpoint": { "type": "string", "format": "uri", "description": "Override for the authorization endpoint" }, "tokenEndpoint": { "type": "string", "format": "uri", "description": "Override for the token endpoint" }, "userinfoEndpoint": { "type": "string", "format": "uri", "description": "Override for the userinfo endpoint" }, "teamIdsField": { "type": "string", "description": "JWT claim field for team IDs" }, "rolesField": { "type": "string", "description": "JWT claim field for roles" }, "scopes": { "type": "array", "description": "Additional OAuth2 scopes to request", "items": { "type": "string" } }, "attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"}, "attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"}, "attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"}, "claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"} }, "required": ["issuerUrl", "clientId"], "additionalProperties": false } } } } ] }, "loadBalancer": { "type": "object", "description": "Load balancer configuration for intelligent request routing", "properties": { "enabled": { "type": "boolean", "description": "Whether load balancing is enabled" }, "directionSelectionEnabled": { "type": "boolean", "description": "Enable adaptive provider (direction) selection. Defaults to true; omit to leave on." }, "routeSelectionEnabled": { "type": "boolean", "description": "Enable adaptive per-key (route) selection. Defaults to true; omit to leave on." }, "rerouteFailedDirections": { "type": "boolean", "description": "When a pinned provider's direction is unhealthy, re-route the request to a healthy provider. Defaults to false." }, "pruneFailedFallbacks": { "type": "boolean", "description": "Drop unhealthy directions from a request's configured fallbacks. Defaults to false." }, "trackerConfig": { "type": "object", "description": "Configuration for tracking route metrics and performance" }, "bootstrap": { "type": "object" } } }, "guardrails": { "type": "object", "description": "Guardrails configuration for content moderation and policy enforcement", "properties": { "rules": { "type": "array", "description": "List of guardrail rules", "items": { "type": "object", "properties": { "id": { "type": "integer", "description": "Unique identifier for the rule" }, "name": { "type": "string", "description": "Name of the guardrail rule" }, "description": { "type": "string", "description": "Description of what the rule does" }, "enabled": { "type": "boolean", "description": "Whether this rule is enabled" }, "cel_expression": { "type": "string", "description": "CEL (Common Expression Language) expression for rule evaluation" }, "query": { "description": "Visual rule builder state for the management UI (react-querybuilder). Omitted unless exported from the dashboard. Not evaluated at runtime (cel_expression is).", "anyOf": [ { "type": "null" }, { "type": "object", "required": ["combinator", "rules"], "properties": { "combinator": { "type": "string", "enum": ["and", "or"] }, "rules": { "type": "array", "items": { "type": "object" }, "description": "Leaf rules and/or nested combinator+rules groups from the query builder." } }, "additionalProperties": true } ] }, "apply_to": { "type": "string", "enum": ["input", "output", "both"], "description": "When to apply the guardrail (input, output, or both)" }, "sampling_rate": { "type": "integer", "minimum": 0, "maximum": 100, "description": "Percentage of requests to apply this rule to (0-100)" }, "timeout": { "type": "integer", "minimum": 0, "description": "Timeout in seconds for rule execution" }, "max_turns_to_send": { "type": "integer", "minimum": 0, "description": "Number of historical conversation turns to send to the guardrail provider; the latest message is always included on top. 0 sends all turns." }, "evaluation_mode": { "type": "string", "enum": ["bundled", "per_turn"], "default": "bundled", "description": "How the rule's turns are sent to its guardrail providers. 'bundled' (default) concatenates all turns into one guardrail call. 'per_turn' sends each turn in its own call, evaluated in isolation, to avoid context-sensitive classifiers (e.g. Bedrock prompt-attack) combining unrelated turns into a false-positive block; this scans every turn but uses more provider calls." }, "provider_config_ids": { "type": "array", "items": { "type": "integer" }, "description": "IDs of provider configurations to use with this rule" } }, "required": ["id", "name", "enabled", "cel_expression", "apply_to"], "additionalProperties": false } }, "providers": { "type": "array", "description": "List of guardrail provider configurations", "items": { "type": "object", "properties": { "id": { "type": "integer", "description": "Unique identifier for the provider config" }, "provider_name": { "type": "string", "description": "Name of the guardrail provider (e.g., 'bedrock', 'azure')" }, "policy_name": { "type": "string", "description": "Name of the specific policy to use" }, "enabled": { "type": "boolean", "description": "Whether this provider config is enabled" }, "timeout": { "type": "integer", "minimum": 0, "description": "Timeout in seconds for provider execution" }, "config": { "type": "object", "description": "Provider-specific configuration" } }, "required": ["id", "provider_name", "policy_name", "enabled"], "additionalProperties": false } } }, "additionalProperties": false }, "skillsRegistry": { "type": "object", "description": "Declarative Skills Repository definitions reconciled from config.json. Rendered verbatim into skills_registry.", "properties": { "enabled": { "type": "boolean", "description": "Whether config-defined skills should be reconciled at startup" }, "skills": { "type": "array", "description": "Skills to create or update from config.json", "items": { "type": "object", "required": ["name", "description", "skill_md_body", "version"], "properties": { "name": { "type": "string" }, "description": { "type": "string" }, "license": { "type": "string" }, "compatibility": { "type": "string" }, "allowed_tools": { "type": "string" }, "extra_frontmatter": { "type": "object", "additionalProperties": true }, "metadata": { "type": "object", "additionalProperties": { "type": "string" } }, "skill_md_body": { "type": "string" }, "version": { "type": "string" }, "files": { "type": "array", "items": { "type": "object", "required": ["path", "source_type"], "properties": { "path": { "type": "string" }, "source_type": { "type": "string", "enum": ["text", "url", "dataurl"] }, "url": { "type": "string" }, "content": { "type": "string" }, "dataurl": { "type": "string" } }, "additionalProperties": false, "oneOf": [ { "properties": { "source_type": { "const": "url" } }, "required": ["url"] }, { "properties": { "source_type": { "const": "text" } }, "required": ["content"] }, { "properties": { "source_type": { "const": "dataurl" } }, "required": ["dataurl"] } ] } } }, "additionalProperties": false } } }, "additionalProperties": false }, "accessProfiles": { "type": "array", "description": "Enterprise access profile templates rendered as top-level access_profiles in config.json", "items": { "type": "object", "properties": { "name": { "type": "string" }, "description": { "type": "string" }, "is_active": { "type": "boolean" }, "tags": { "type": "array", "items": { "type": "string" } }, "budgets": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "max_limit": { "type": "number" }, "reset_duration": { "type": "string" } }, "required": ["id", "max_limit", "reset_duration"], "additionalProperties": false } }, "rate_limit": { "type": "object", "properties": { "id": { "type": "string" }, "token_max_limit": { "type": "integer" }, "token_reset_duration": { "type": "string" }, "request_max_limit": { "type": "integer" }, "request_reset_duration": { "type": "string" } }, "required": ["id"], "additionalProperties": false }, "provider_configs": { "type": "array", "items": { "type": "object", "properties": { "provider_name": { "type": "string" }, "all_models_allowed": { "type": "boolean" }, "allowed_models": { "type": "array", "items": { "type": "string" } }, "budgets": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "max_limit": { "type": "number" }, "reset_duration": { "type": "string" } }, "required": ["id", "max_limit", "reset_duration"], "additionalProperties": false } }, "rate_limit": { "type": "object", "properties": { "id": { "type": "string" }, "token_max_limit": { "type": "integer" }, "token_reset_duration": { "type": "string" }, "request_max_limit": { "type": "integer" }, "request_reset_duration": { "type": "string" } }, "additionalProperties": false }, "key_ids": { "type": "array", "description": "Key IDs allowed for this provider config. Use [\"*\"] to allow all keys; empty array or omitted denies all keys. Specific IDs restrict access to those keys only.", "items": { "type": "string" } } }, "required": ["provider_name"], "additionalProperties": false } }, "mcp_tool_groups": { "type": "array", "items": { "type": "object", "properties": { "tool_group_id": { "type": "integer" } }, "required": ["tool_group_id"], "additionalProperties": false } }, "mcp_servers": { "type": "array", "items": { "type": "object", "properties": { "mcp_server_id": { "type": "string" } }, "required": ["mcp_server_id"], "additionalProperties": false } }, "mcp_tool_overrides": { "type": "array", "items": { "type": "object", "properties": { "mcp_client_id": { "type": "string" }, "tool_name": { "type": "string" }, "action": { "type": "string", "enum": ["include", "exclude"] } }, "required": ["mcp_client_id", "tool_name", "action"], "additionalProperties": false } } }, "required": ["name"], "additionalProperties": false } }, "auditLogs": { "type": "object", "properties": { "disabled": { "type": "boolean" }, "hmacKey": { "type": "string" } } }, "largePayloadOptimization": { "type": "object", "description": "Large payload streaming optimization configuration", "properties": { "enabled": { "type": "boolean", "default": false }, "requestThresholdBytes": { "type": "integer", "minimum": 0, "default": 10485760 }, "responseThresholdBytes": { "type": "integer", "minimum": 0, "default": 10485760 }, "prefetchSizeBytes": { "type": "integer", "minimum": 0, "default": 65536 }, "maxPayloadBytes": { "type": "integer", "minimum": 0, "default": 524288000 }, "truncatedLogBytes": { "type": "integer", "minimum": 0, "default": 1048576 } } }, "websocket": { "type": "object", "description": "Optional tuning for the WebSocket gateway (Responses API WebSocket Mode, Realtime API). WebSocket is always enabled; these fields override the high defaults.", "properties": { "maxConnectionsPerUser": { "type": "integer", "minimum": 1, "description": "Maximum concurrent WebSocket connections per user", "default": 100 }, "transcriptBufferSize": { "type": "integer", "minimum": 1, "description": "Number of transcript entries to buffer for Realtime API mid-session fallback", "default": 100 }, "pool": { "type": "object", "description": "Upstream WebSocket connection pool configuration", "properties": { "maxIdlePerKey": { "type": "integer", "minimum": 1, "description": "Maximum idle connections per provider/key combination", "default": 50 }, "maxTotalConnections": { "type": "integer", "minimum": 1, "description": "Maximum total idle connections across all providers", "default": 1000 }, "idleTimeoutSeconds": { "type": "integer", "minimum": 1, "description": "Seconds before an idle connection is evicted", "default": 600 }, "maxConnectionLifetimeSeconds": { "type": "integer", "minimum": 1, "description": "Maximum lifetime of a connection in seconds", "default": 7200 } }, "additionalProperties": false } }, "additionalProperties": false }, "circuitBreakerConfig": { "type": "object", "description": "Circuit breaker configuration for automatic failover when a provider endpoint degrades", "properties": { "policies": { "type": "array", "description": "List of circuit breaker policies", "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Unique name for this policy" }, "enabled": { "type": "boolean", "description": "Whether this policy is active" }, "primary_provider": { "type": "string", "description": "Provider to monitor (e.g. 'azure', 'openai')" }, "primary_model": { "type": "string", "description": "Model to monitor as it appears in requests" }, "primary_key_ids": { "type": "array", "description": "Optional key UUIDs to monitor individually; empty uses a single shared circuit", "items": { "type": "string" } }, "fallback_provider": { "type": "string", "description": "Provider to route to when the circuit is open" }, "fallback_model": { "type": "string", "description": "Model to request from the fallback provider" }, "condition": { "type": "object", "description": "Response signals that trigger the circuit to open", "properties": { "operator": { "type": "string", "enum": ["OR", "AND"], "default": "OR" }, "signals": { "type": "array", "minItems": 1, "items": { "type": "object", "properties": { "source": { "type": "string", "enum": ["response_header"] }, "header_name": { "type": "string" }, "header_value": { "type": "string" }, "header_contains": { "type": "string" } }, "required": ["source", "header_name"], "additionalProperties": false } } }, "required": ["signals"], "additionalProperties": false }, "default_cooldown": { "type": "string", "pattern": "^[0-9]+(ns|us|µs|ms|s|m|h)$", "description": "How long to keep the circuit open when no header-based cooldown is available (Go duration, e.g. '30s')" }, "cooldown_header": { "type": "string", "description": "Response header whose value (in ms) overrides default_cooldown" } }, "required": ["name", "primary_provider", "primary_model", "fallback_provider", "fallback_model", "condition"], "additionalProperties": false } } }, "additionalProperties": false } } }, "storage": { "type": "object", "properties": { "mode": { "type": "string", "enum": ["sqlite", "postgres"] }, "persistence": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "storageClass": { "type": "string" }, "accessMode": { "type": "string", "enum": ["ReadWriteOnce", "ReadWriteMany", "ReadOnlyMany"] }, "size": { "type": "string" }, "existingClaim": { "type": "string" } } }, "configStore": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "type": { "type": "string", "enum": ["", "sqlite", "postgres"] }, "maxIdleConns": { "type": "integer", "minimum": 0 }, "maxOpenConns": { "type": "integer", "minimum": 2 }, "vaultStore": { "type": "object", "description": "Vault store for external secret management", "properties": { "enabled": { "type": "boolean" }, "type": { "type": "string", "enum": ["aws-secrets-manager", "gcp-secret-manager", "hashicorp-vault"] }, "prefix": { "type": "string" }, "accessMode": { "type": "string", "enum": ["read_only", "read_and_write"] }, "aws": { "type": "object", "description": "AWS Secrets Manager configuration", "properties": { "region": { "type": "string" }, "accessKeyId": { "type": "string" }, "secretAccessKey": { "type": "string" }, "sessionToken": { "type": "string" }, "roleArn": { "type": "string" }, "kmsKeyId": { "type": "string" } }, "additionalProperties": false }, "gcp": { "type": "object", "description": "GCP Secret Manager configuration", "properties": { "projectId": { "type": "string" }, "credentialsJson": { "type": "string" } }, "additionalProperties": false }, "hashicorp": { "type": "object", "description": "HashiCorp Vault (KV v2) configuration", "properties": { "address": { "type": "string" }, "token": { "type": "string" }, "namespace": { "type": "string" }, "mountPath": { "type": "string" }, "roleId": { "type": "string" }, "secretId": { "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false } } }, "logsStore": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "type": { "type": "string", "enum": ["", "sqlite", "postgres", "clickhouse"] }, "maxIdleConns": { "type": "integer", "minimum": 0 }, "maxOpenConns": { "type": "integer", "minimum": 2 }, "matviewRefreshInterval": { "type": "string", "description": "How often to refresh materialized views. Go duration string (e.g. '30s', '5m', '1h'). Minimum 5s.", "pattern": "^[0-9]+(ns|us|µs|ms|s|m|h)$" }, "clickhouse": { "type": "object", "description": "ClickHouse connection settings (only applies when type is clickhouse)", "properties": { "host": { "type": "string", "description": "ClickHouse host" }, "port": { "type": ["string", "integer"], "description": "ClickHouse port. Defaults by protocol: native 9000 (9440 TLS), http 8123 (8443 TLS)" }, "database": { "type": "string", "description": "ClickHouse database name (default: default)" }, "username": { "type": "string", "description": "ClickHouse username" }, "password": { "type": "string", "description": "ClickHouse password (can use env. prefix)" }, "protocol": { "type": "string", "enum": ["native", "http"], "description": "ClickHouse wire protocol (default: native)" }, "secure": { "type": "boolean", "description": "Enable TLS (native: secure=true; http: switches to https)" }, "dialTimeout": { "type": "integer", "minimum": 1, "description": "Connection dial timeout in milliseconds (default: 10000)" }, "cluster": { "type": "string", "description": "Optional cluster name; when set, DDL runs ON CLUSTER with replicated table engines" } }, "required": ["host"], "additionalProperties": false }, "writer": { "type": "object", "description": "Async logging writer queue and batch tuning", "properties": { "maxBatchSize": { "type": "integer", "minimum": 1 }, "batchInterval": { "type": "string", "pattern": "^[1-9][0-9]*(ns|us|µs|ms|s|m|h)$" }, "maxBatchBytes": { "type": "integer", "minimum": 1 }, "writeQueueCapacity": { "type": "integer", "minimum": 1 }, "deferredUsageConcurrency": { "type": "integer", "minimum": 1 } }, "additionalProperties": false }, "objectStorageExcludeFields": { "type": "array", "items": { "type": "string" } }, "objectStorage": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "type": { "type": "string", "enum": ["s3", "gcs"] }, "bucket": { "type": "string" }, "prefix": { "type": "string" }, "compress": { "type": "boolean" }, "region": { "type": "string" }, "endpoint": { "type": "string" }, "accessKeyId": { "type": "string" }, "secretAccessKey": { "type": "string" }, "sessionToken": { "type": "string" }, "roleArn": { "type": "string" }, "forcePathStyle": { "type": "boolean" }, "projectId": { "type": "string" }, "credentialsJson": { "type": "string" }, "existingSecret": { "type": "string" }, "accessKeyIdKey": { "type": "string" }, "secretAccessKeyKey": { "type": "string" }, "sessionTokenKey": { "type": "string" }, "roleArnKey": { "type": "string" }, "credentialsJsonKey": { "type": "string" } }, "if": { "properties": { "enabled": { "const": true } }, "required": ["enabled"] }, "then": { "required": ["type", "bucket"] } } } } } }, "postgresql": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "external": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "host": { "type": "string" }, "port": { "type": "integer", "minimum": 1, "maximum": 65535 }, "user": { "type": "string" }, "password": { "type": "string" }, "passwordCommand": { "type": "object", "description": "Command executed by Bifrost to produce the PostgreSQL password on stdout for each new physical connection", "properties": { "command": { "type": "string", "minLength": 1, "pattern": "^\\S+$" }, "args": { "type": "array", "items": { "type": "string" } }, "timeout": { "type": "string", "pattern": "^[1-9][0-9]*(ns|us|µs|ms|s|m|h)$" } }, "required": ["command"], "additionalProperties": false }, "connMaxLifetime": { "type": "string", "pattern": "^[1-9][0-9]*(ns|us|µs|ms|s|m|h)$" }, "database": { "type": "string" }, "sslMode": { "type": "string", "enum": ["disable", "allow", "prefer", "require", "verify-ca", "verify-full"] }, "existingSecret": { "type": "string" }, "passwordKey": { "type": "string" } }, "allOf": [ { "if": { "properties": { "enabled": { "const": true } } }, "then": { "required": ["host", "port", "user", "database", "sslMode"] } }, { "not": { "required": ["password", "passwordCommand"] } }, { "not": { "required": ["existingSecret", "passwordCommand"] } } ] }, "image": { "type": "object", "properties": { "repository": { "type": "string" }, "tag": { "type": "string" }, "pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] } } }, "auth": { "type": "object", "properties": { "username": { "type": "string" }, "password": { "type": "string" }, "database": { "type": "string" }, "existingSecret": { "type": "string" }, "passwordKey": { "type": "string" } } }, "primary": { "type": "object", "properties": { "persistence": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "size": { "type": "string" }, "storageClass": { "type": "string" } } }, "resources": { "type": "object" }, "podSecurityContext": { "type": "object" }, "containerSecurityContext": { "type": "object" }, "nodeSelector": { "type": "object" }, "tolerations": { "type": "array", "items": { "type": "object" } }, "affinity": { "type": "object" } } }, "metrics": { "type": "object", "properties": { "enabled": { "type": "boolean" } } } } }, "vectorStore": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "type": { "type": "string", "enum": ["none", "weaviate", "redis", "qdrant", "pinecone"] }, "weaviate": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "external": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "scheme": { "type": "string", "enum": ["http", "https"] }, "host": { "type": "string", "description": "Weaviate server host (host:port)" }, "apiKey": { "type": "string", "description": "API key for Weaviate authentication" }, "grpcHost": { "type": "string", "description": "Weaviate gRPC host (host:port)" }, "grpcSecured": { "type": "boolean", "description": "Whether gRPC connection is secured" }, "timeout": { "type": "string", "pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$", "description": "Timeout for Weaviate operations (e.g., '5s')" }, "className": { "type": "string", "description": "Class name for Weaviate vector store" }, "existingSecret": { "type": "string" }, "apiKeyKey": { "type": "string" } }, "if": { "properties": { "enabled": { "const": true } } }, "then": { "required": ["scheme", "host"] } }, "replicas": { "type": "integer", "minimum": 1 }, "image": { "type": "object" }, "persistence": { "type": "object" }, "resources": { "type": "object" }, "env": { "type": "object" } } }, "redis": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "external": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "host": { "type": "string", "description": "Redis/Valkey server host" }, "port": { "type": "integer", "minimum": 1, "maximum": 65535, "description": "Redis/Valkey server port" }, "username": { "type": "string", "description": "Username for Redis/Valkey AUTH" }, "password": { "type": "string", "description": "Password for Redis/Valkey AUTH" }, "database": { "type": "integer", "minimum": 0, "default": 0, "description": "Redis/Valkey database number" }, "useTls": { "type": "boolean", "default": false, "description": "Enable TLS for the Redis/Valkey connection" }, "insecureSkipVerify": { "type": "boolean", "default": false, "description": "Skip TLS certificate verification for Redis/Valkey connections" }, "caCertPem": { "type": "string", "description": "PEM-encoded CA certificate to trust for Redis/Valkey TLS connections" }, "clusterMode": { "type": "boolean", "default": false, "description": "Use Redis Cluster mode for cluster configuration endpoints" }, "poolSize": { "type": "integer", "description": "Maximum number of socket connections" }, "maxActiveConns": { "type": "integer", "description": "Maximum number of active connections" }, "minIdleConns": { "type": "integer", "description": "Minimum number of idle connections" }, "maxIdleConns": { "type": "integer", "description": "Maximum number of idle connections" }, "connMaxLifetime": { "type": "string", "pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$", "description": "Connection maximum lifetime (e.g., '30m')" }, "connMaxIdleTime": { "type": "string", "pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$", "description": "Connection maximum idle time (e.g., '5m')" }, "dialTimeout": { "type": "string", "pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$", "description": "Timeout for socket connection (e.g., '5s')" }, "readTimeout": { "type": "string", "pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$", "description": "Timeout for socket reads (e.g., '3s')" }, "writeTimeout": { "type": "string", "pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$", "description": "Timeout for socket writes (e.g., '3s')" }, "contextTimeout": { "type": "string", "pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$", "description": "Timeout for Redis/Valkey operations (e.g., '10s')" }, "existingSecret": { "type": "string" }, "passwordKey": { "type": "string" } }, "if": { "properties": { "enabled": { "const": true } } }, "then": { "required": ["host"] } }, "image": { "type": "object" }, "auth": { "type": "object" }, "master": { "type": "object" }, "metrics": { "type": "object" } } }, "qdrant": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "external": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "host": { "type": "string", "description": "Qdrant server host" }, "port": { "type": "integer", "minimum": 1, "maximum": 65535, "default": 6334, "description": "Qdrant server port (default: 6334 for gRPC)" }, "apiKey": { "type": "string", "description": "API key for authentication" }, "useTls": { "type": "boolean", "default": false, "description": "Use TLS for connection" }, "existingSecret": { "type": "string" }, "apiKeyKey": { "type": "string" } }, "if": { "properties": { "enabled": { "const": true } } }, "then": { "required": ["host"] } }, "image": { "type": "object" }, "persistence": { "type": "object" }, "resources": { "type": "object" } } }, "pinecone": { "type": "object", "description": "Pinecone configuration for vector store", "properties": { "enabled": { "type": "boolean" }, "external": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "apiKey": { "type": "string", "description": "Pinecone API key" }, "indexHost": { "type": "string", "description": "Index host URL from Pinecone console (e.g., your-index.svc.environment.pinecone.io)" }, "existingSecret": { "type": "string", "description": "Name of existing secret containing Pinecone API key" }, "apiKeyKey": { "type": "string", "description": "Key in the secret containing the API key" } }, "if": { "properties": { "enabled": { "const": true } } }, "then": { "required": ["indexHost"] } } } } } }, "env": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "string" }, "valueFrom": { "type": "object" } }, "required": ["name"] } }, "envFrom": { "type": "array", "items": { "type": "object" } }, "initContainers": { "type": "array", "items": { "type": "object" } } }, "$defs": { "otelEndpoint": { "type": "string", "description": "OpenTelemetry endpoint URL or host:port. Supports env.VAR_NAME prefix for environment variable substitution.", "anyOf": [ { "format": "uri" }, { "pattern": "^[^:\\s]+:\\d+$" }, { "pattern": "^env\\.[A-Za-z_][A-Za-z0-9_]*$" }, { "const": "" } ] }, "pluginSpanFilter": { "type": "object", "description": "Controls which plugin hook spans this observability connector exports. Omit to export all plugin spans. Mode \"include\" exports only the listed plugins; mode \"exclude\" exports everything except them.", "properties": { "mode": { "type": "string", "enum": ["include", "exclude"] }, "plugins": { "type": "array", "items": { "type": "string" } } }, "required": ["mode", "plugins"], "additionalProperties": false }, "otelProfileConfig": { "type": "object", "description": "OpenTelemetry export profile. This legacy single-profile shape is still accepted directly as bifrost.plugins.otel.config.", "properties": { "enabled": { "type": "boolean", "description": "Whether this profile exports traces and metrics", "default": true }, "service_name": { "type": "string", "description": "Service name to be used for tracing", "default": "bifrost" }, "collector_url": { "$ref": "#/$defs/otelEndpoint", "description": "URL of the OpenTelemetry collector" }, "trace_type": { "type": "string", "enum": ["genai_extension", "vercel", "open_inference"], "description": "Type of trace to use for the OTEL collector" }, "protocol": { "type": "string", "enum": ["http", "grpc"], "description": "Protocol to use for the OTEL collector" }, "metrics_enabled": { "type": "boolean", "description": "Enable push-based metrics export via OTLP. Recommended for multi-node cluster deployments.", "default": false }, "metrics_endpoint": { "$ref": "#/$defs/otelEndpoint", "description": "OTLP metrics endpoint URL (e.g., http://otel-collector:4318/v1/metrics for HTTP or otel-collector:4317 for gRPC)" }, "metrics_push_interval": { "type": "integer", "description": "Metrics push interval in seconds", "default": 15, "minimum": 1, "maximum": 300 }, "headers": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom headers for the collector (supports env.VAR_NAME prefix)" }, "tls_ca_cert": { "type": "string", "description": "Path to TLS CA certificate file" }, "insecure": { "type": "boolean", "description": "Skip TLS verification (ignored if tls_ca_cert is set)", "default": false }, "disable_content_logging": { "type": "boolean", "description": "When true, message content (input/output messages, embeddings, tool definitions, and tool call arguments/results) is dropped from exported spans. Only metadata such as model, tokens, and latency is sent to the collector.", "default": false }, "group_traces_by_session": { "type": "boolean", "description": "When true, requests sharing the same x-bf-session-id header are grouped into a single OTEL trace, each request's root span appearing as a top-level sibling. An inbound W3C traceparent takes precedence, leaving that request on its own distributed trace.", "default": false }, "disable_root_span_content": { "type": "boolean", "description": "When true, input/output message content is dropped from the root span only; the underlying generation (llm.call) span retains the full content. This removes the duplicate input/output stored at the trace level (e.g. the Langfuse trace Input/Output goes empty) to reduce downstream storage.", "default": false }, "plugin_span_filter": { "$ref": "#/$defs/pluginSpanFilter" } }, "allOf": [ { "if": { "not": { "properties": { "enabled": { "const": false } }, "required": ["enabled"] } }, "then": { "required": ["collector_url", "trace_type", "protocol"] } }, { "if": { "properties": { "metrics_enabled": { "const": true } }, "required": ["metrics_enabled"] }, "then": { "required": ["metrics_endpoint"] } } ], "additionalProperties": false }, "otelProfilesConfig": { "type": "object", "description": "OpenTelemetry plugin configuration with one or more export profiles.", "properties": { "profiles": { "type": "array", "description": "OpenTelemetry export profiles", "items": { "$ref": "#/$defs/otelProfileConfig" }, "minItems": 1 }, "plugin_span_filter": { "$ref": "#/$defs/pluginSpanFilter" }, "enabled": { "type": "boolean", "description": "Deprecated in the profiles wrapper; kept only so Helm's default map merge does not reject values that switch from the legacy shape to profiles." }, "service_name": { "type": "string", "description": "Deprecated in the profiles wrapper; configure service_name per profile instead." }, "collector_url": { "$ref": "#/$defs/otelEndpoint", "description": "Deprecated in the profiles wrapper; configure collector_url per profile instead." }, "trace_type": { "type": "string", "enum": ["genai_extension", "vercel", "open_inference"], "description": "Deprecated in the profiles wrapper; configure trace_type per profile instead." }, "protocol": { "type": "string", "enum": ["http", "grpc"], "description": "Deprecated in the profiles wrapper; configure protocol per profile instead." }, "metrics_enabled": { "type": "boolean", "description": "Deprecated in the profiles wrapper; configure metrics_enabled per profile instead." }, "metrics_endpoint": { "$ref": "#/$defs/otelEndpoint", "description": "Deprecated in the profiles wrapper; configure metrics_endpoint per profile instead." }, "metrics_push_interval": { "type": "integer", "minimum": 1, "maximum": 300, "description": "Deprecated in the profiles wrapper; configure metrics_push_interval per profile instead." }, "headers": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Deprecated in the profiles wrapper; configure headers per profile instead." }, "tls_ca_cert": { "type": "string", "description": "Deprecated in the profiles wrapper; configure tls_ca_cert per profile instead." }, "insecure": { "type": "boolean", "description": "Deprecated in the profiles wrapper; configure insecure per profile instead." }, "disable_content_logging": { "type": "boolean", "description": "Deprecated in the profiles wrapper; configure disable_content_logging per profile instead." }, "group_traces_by_session": { "type": "boolean", "description": "Deprecated in the profiles wrapper; configure group_traces_by_session per profile instead." }, "disable_root_span_content": { "type": "boolean", "description": "Deprecated in the profiles wrapper; configure disable_root_span_content per profile instead." } }, "required": ["profiles"], "additionalProperties": false }, "authConfig": { "type": "object", "description": "Authentication configuration. Deprecated: Use governance.auth_config instead.", "properties": { "adminUsername": { "type": "string", "description": "Admin username" }, "adminPassword": { "type": "string", "description": "Admin password" }, "isEnabled": { "type": "boolean", "description": "Whether authentication is enabled" }, "disableAuthOnInference": { "type": "boolean", "deprecated": true, "description": "Deprecated and ignored. Use client.enforceAuthOnInference instead." }, "existingSecret": { "type": "string" }, "usernameKey": { "type": "string" }, "passwordKey": { "type": "string" } }, "additionalProperties": false }, "pluginBase": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "config": { "type": "object" } } }, "provider": { "type": "object", "properties": { "keys": { "type": "array", "items": { "$ref": "#/$defs/providerKey" }, "minItems": 1 }, "network_config": { "$ref": "#/$defs/networkConfig" }, "concurrency_and_buffer_size": { "$ref": "#/$defs/concurrencyConfig" }, "proxy_config": { "$ref": "#/$defs/proxyConfig" }, "send_back_raw_request": { "type": "boolean", "description": "Include raw request in BifrostResponse" }, "send_back_raw_response": { "type": "boolean" }, "store_raw_request_response": { "type": "boolean", "description": "Capture raw request/response for plugins only; stripped before returning to client" }, "custom_provider_config": { "type": "object", "description": "Custom provider configuration", "properties": { "is_key_less": { "type": "boolean" }, "base_provider_type": { "type": "string" }, "allowed_requests": { "type": "object", "additionalProperties": { "type": "boolean" } }, "request_path_overrides": { "type": "object", "additionalProperties": { "type": "string" } } }, "required": ["base_provider_type"] }, "pricing_overrides": { "type": "array", "description": "Provider-level pricing overrides", "items": { "type": "object", "properties": { "model_pattern": { "type": "string" }, "match_type": { "type": "string", "enum": ["exact", "wildcard", "regex"] } }, "required": ["model_pattern", "match_type"] } } }, "required": ["keys"] }, "providerKey": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "string" }, "models": { "type": "array", "items": { "type": "string" } }, "weight": { "type": "number", "minimum": 0, "default": 1, "description": "Routing weight for this key. Optional; defaults to 1 when omitted." }, "use_for_batch_api": { "type": "boolean" }, "azure_key_config": { "type": "object", "properties": { "endpoint": { "type": "string", "description": "Azure endpoint (can use env. prefix)" }, "client_id": { "type": "string", "description": "Azure client ID for authentication (can use env. prefix)" }, "client_secret": { "type": "string", "description": "Azure client secret for authentication (can use env. prefix)" }, "tenant_id": { "type": "string", "description": "Azure tenant ID for authentication (can use env. prefix)" }, "scopes": { "type": "array", "items": { "type": "string" }, "description": "Azure scopes for authentication" }, "deployments": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Model to deployment mappings" }, "api_version": { "type": "string", "description": "Azure API version" } }, "required": ["endpoint"], "dependentRequired": { "client_id": ["client_secret", "tenant_id"], "client_secret": ["client_id", "tenant_id"], "tenant_id": ["client_id", "client_secret"] }, "additionalProperties": false }, "vertex_key_config": { "type": "object", "properties": { "project_id": { "type": "string", "description": "Google Cloud project ID (can use env. prefix)" }, "project_number": { "type": "string", "description": "Google Cloud project number" }, "region": { "type": "string", "description": "Google Cloud region" }, "auth_credentials": { "type": "string", "description": "Authentication credentials (can use env. prefix)" }, "deployments": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Model to deployment mappings" } }, "required": ["project_id", "region"], "additionalProperties": false }, "bedrock_key_config": { "type": "object", "properties": { "access_key": { "type": "string", "description": "AWS access key (can use env. prefix)" }, "secret_key": { "type": "string", "description": "AWS secret key (can use env. prefix)" }, "session_token": { "type": "string", "description": "AWS session token (can use env. prefix)" }, "region": { "type": "string", "description": "AWS region" }, "arn": { "type": "string", "description": "AWS ARN" }, "role_arn": { "type": "string", "description": "AWS IAM role ARN for AssumeRole (can use env. prefix)" }, "external_id": { "type": "string", "description": "External ID for AssumeRole (can use env. prefix)" }, "session_name": { "type": "string", "description": "Role session name for AssumeRole (can use env. prefix)" }, "deployments": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Model to deployment mappings" }, "batch_s3_config": { "type": "object", "description": "S3 bucket configuration for Bedrock batch operations", "properties": { "buckets": { "type": "array", "description": "List of S3 bucket configurations", "items": { "type": "object", "properties": { "bucket_name": { "type": "string", "description": "S3 bucket name" }, "prefix": { "type": "string", "description": "S3 key prefix for batch files" }, "is_default": { "type": "boolean", "description": "Whether this is the default bucket for batch operations" } }, "required": ["bucket_name"], "additionalProperties": false } } }, "additionalProperties": false } }, "required": ["region"], "additionalProperties": false }, "bedrock_mantle_key_config": { "type": "object", "properties": { "access_key": { "type": "string", "description": "AWS access key for SigV4 (can use env. prefix)" }, "secret_key": { "type": "string", "description": "AWS secret key for SigV4 (can use env. prefix)" }, "session_token": { "type": "string", "description": "AWS session token for temporary credentials (can use env. prefix)" }, "region": { "type": "string", "description": "AWS region used to build the bedrock-mantle endpoint host" }, "role_arn": { "type": "string", "description": "AWS IAM role ARN for AssumeRole (can use env. prefix)" }, "external_id": { "type": "string", "description": "External ID for AssumeRole (can use env. prefix)" }, "session_name": { "type": "string", "description": "Role session name for AssumeRole (can use env. prefix)" } }, "required": ["region"], "additionalProperties": false }, "vllm_key_config": { "type": "object", "properties": { "url": { "type": "string", "description": "VLLM server base URL (can use env. prefix)" }, "model_name": { "type": "string", "description": "Exact model name served on this VLLM instance" } }, "required": ["url", "model_name"], "additionalProperties": false }, "aliases": { "type": "object", "additionalProperties": { "oneOf": [ { "type": "string", "minLength": 1, "description": "Legacy shape: a bare provider-specific identifier. Equivalent to {\"model_id\": \"\"}." }, { "type": "object", "properties": { "model_id": { "type": "string", "minLength": 1, "description": "Provider-specific identifier sent on the wire (deployment name, inference profile ID, fine-tuned model ID, etc.)." }, "model_name": { "type": "string", "description": "Canonical model name used for pricing, logging, and family inference." }, "model_family": { "type": "string", "enum": ["anthropic", "openai", "mistral", "cohere", "gemini", "nova", "titan"], "description": "Underlying model family. Used by provider routing without substring-sniffing the wire model ID." }, "description": { "type": "string" }, "region": { "type": "string", "description": "Per-alias region override (can use env. prefix)." }, "api_version": { "type": "string", "description": "Azure OpenAI api-version override for this alias." }, "anthropic_version": { "type": "string", "description": "Azure anthropic-version header override for Claude-on-Azure deployments." }, "endpoint": { "type": "string", "description": "Per-alias Azure endpoint override (can use env. prefix)." }, "project_id": { "type": "string", "description": "Per-alias Vertex project ID override (can use env. prefix)." }, "project_number": { "type": "string", "description": "Per-alias Vertex project number override (can use env. prefix)." }, "inference_profile_arn": { "type": "string", "description": "Per-alias Bedrock inference profile ARN (can use env. prefix)." }, "use_deployments_endpoint": { "type": "boolean", "description": "Replicate: use the deployments endpoint instead of the predictions endpoint for this alias." } }, "required": ["model_id"], "additionalProperties": false } ] }, "propertyNames": { "minLength": 1 }, "description": "Model alias mappings: each entry maps a user-facing model name to either a bare provider identifier (legacy string shape) or an AliasConfig object carrying the wire identifier plus optional canonical name, family, and provider-specific overrides." } }, "required": ["name", "weight"], "oneOf": [ { "not": { "anyOf": [ { "required": ["azure_key_config"] }, { "required": ["vertex_key_config"] }, { "required": ["bedrock_key_config"] }, { "required": ["bedrock_mantle_key_config"] }, { "required": ["vllm_key_config"] } ] } }, { "required": ["azure_key_config"], "not": { "anyOf": [ { "required": ["vertex_key_config"] }, { "required": ["bedrock_key_config"] }, { "required": ["bedrock_mantle_key_config"] }, { "required": ["vllm_key_config"] } ] } }, { "required": ["vertex_key_config"], "not": { "anyOf": [ { "required": ["azure_key_config"] }, { "required": ["bedrock_key_config"] }, { "required": ["bedrock_mantle_key_config"] }, { "required": ["vllm_key_config"] } ] } }, { "required": ["bedrock_key_config"], "not": { "anyOf": [ { "required": ["azure_key_config"] }, { "required": ["vertex_key_config"] }, { "required": ["bedrock_mantle_key_config"] }, { "required": ["vllm_key_config"] } ] } }, { "required": ["bedrock_mantle_key_config"], "not": { "anyOf": [ { "required": ["azure_key_config"] }, { "required": ["vertex_key_config"] }, { "required": ["bedrock_key_config"] }, { "required": ["vllm_key_config"] } ] } }, { "required": ["vllm_key_config"], "not": { "anyOf": [ { "required": ["azure_key_config"] }, { "required": ["vertex_key_config"] }, { "required": ["bedrock_key_config"] }, { "required": ["bedrock_mantle_key_config"] } ] } } ] }, "networkConfig": { "type": "object", "properties": { "base_url": { "type": "string", "format": "uri", "description": "Base URL for the provider (optional, required for Ollama)" }, "extra_headers": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Additional headers to send with requests" }, "default_request_timeout_in_seconds": { "type": "integer", "minimum": 1, "description": "Default request timeout in seconds" }, "max_retries": { "type": "integer", "minimum": 0, "description": "Maximum number of retries" }, "retry_backoff_initial_ms": { "type": "integer", "minimum": 100, "description": "Initial retry backoff in milliseconds" }, "retry_backoff_max_ms": { "type": "integer", "minimum": 100, "description": "Maximum retry backoff in milliseconds" }, "insecure_skip_verify": { "type": "boolean", "description": "Disable TLS certificate verification for provider connections. This bypasses server certificate validation and should be used only as a last resort when a trusted CA chain cannot be configured. Prefer ca_cert_pem for self-signed or private CA deployments." }, "ca_cert_pem": { "type": "string", "description": "PEM-encoded CA certificate to trust for provider endpoint connections (e.g. self-signed or internal CA). Supports inline PEM or env.VAR_NAME." }, "stream_idle_timeout_in_seconds": { "type": "integer", "minimum": 5, "maximum": 3600, "description": "Idle timeout per stream chunk in seconds. If no data is received for this many seconds, the stream is closed. Default: 60." }, "max_conns_per_host": { "type": "integer", "minimum": 1, "maximum": 10000, "description": "Maximum number of TCP connections per provider host. For HTTP/2 (e.g. Bedrock), each connection supports ~100 concurrent streams. Default: 5000." }, "enforce_http2": { "type": "boolean", "description": "Force HTTP/2 on provider connections (relevant for Bedrock and other net/http-based providers)" }, "beta_header_overrides": { "type": "object", "additionalProperties": { "type": "boolean" }, "description": "Override default Anthropic beta header support per provider. Keys are header prefixes (e.g. 'redact-thinking-'), values are true (supported) or false (unsupported). Headers not listed use the built-in defaults." }, "allow_private_network": { "type": "boolean", "description": "Allow connections to RFC 1918 private IPs (10.x, 172.16.x, 192.168.x). Enable for providers on a k8s pod network, LAN, or private VPC. Loopback addresses (localhost, 127.0.0.1, ::1) remain allowed regardless of this setting. Link-local addresses (169.254.x.x) are always blocked.", "default": false } }, "additionalProperties": false }, "concurrencyConfig": { "type": "object", "properties": { "concurrency": { "type": "integer", "minimum": 1, "description": "Number of concurrent requests" }, "buffer_size": { "type": "integer", "minimum": 1, "description": "Buffer size for requests" } }, "required": ["concurrency", "buffer_size"], "additionalProperties": false }, "proxyConfig": { "type": "object", "description": "Proxy configuration for provider connections", "properties": { "type": { "type": "string", "enum": ["none", "http", "socks5", "environment"], "description": "Type of proxy to use" }, "url": { "oneOf": [ { "type": "string", "pattern": "^env\\.[A-Za-z_][A-Za-z0-9_]*$" }, { "type": "string", "format": "uri", "not": { "pattern": "^env\\.[A-Za-z_][A-Za-z0-9_]*$" } } ], "description": "URL of the proxy server (supports env.VAR_NAME or a literal URI)" }, "username": { "type": "string", "description": "Username for proxy authentication (supports env.VAR_NAME)" }, "password": { "type": "string", "description": "Password for proxy authentication (supports env.VAR_NAME)" }, "ca_cert_pem": { "type": "string", "description": "PEM-encoded CA certificate to trust for TLS connections through the proxy (for SSL-intercepting proxies, supports env.VAR_NAME)" } }, "required": ["type"], "additionalProperties": false }, "mcpClientConfig": { "type": "object", "properties": { "clientId": { "type": "string", "description": "MCP client identifier" }, "name": { "type": "string" }, "isCodeModeClient": { "type": "boolean", "description": "Whether this client is a code mode client" }, "connectionType": { "type": "string", "enum": ["stdio", "websocket", "http", "sse"] }, "connectionString": { "type": "string", "description": "HTTP or SSE URL (required for HTTP or SSE connections)" }, "secretRef": { "type": "object", "description": "Reference to an existing Kubernetes secret holding the MCP connection_string. Chart injects BIFROST_MCP__CONNECTION_STRING and rewrites connection_string in config.json.", "properties": { "name": { "type": "string" }, "connectionStringKey": { "type": "string", "default": "connection-string" } }, "additionalProperties": false }, "authType": { "type": "string", "enum": ["none", "headers", "oauth", "per_user_oauth", "per_user_headers"], "description": "Authentication type for MCP connection" }, "oauthConfigId": { "type": "string", "description": "OAuth config ID reference" }, "headers": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Headers for auth" }, "stdioConfig": { "type": "object", "properties": { "command": { "type": "string" }, "args": { "type": "array", "items": { "type": "string" } }, "envs": { "type": "array", "items": { "type": "string" } } }, "required": ["command"] }, "websocketConfig": { "type": "object", "properties": { "url": { "type": "string", "format": "uri" } }, "required": ["url"] }, "httpConfig": { "type": "object", "properties": { "url": { "type": "string", "format": "uri" } }, "required": ["url"] }, "toolsToExecute": { "type": "array", "items": { "type": "string" }, "description": "Include-only list of tools to execute" }, "toolsToAutoExecute": { "type": "array", "items": { "type": "string" }, "description": "Auto-execute list of tools" }, "toolSyncInterval": { "type": "string", "description": "Per-client override for tool sync interval" }, "toolExecutionTimeout": { "type": ["string", "integer"], "description": "Per-client override for tool execution timeout. Go duration string (e.g. '30s', '2m') or a bare integer treated as seconds. Overrides the global mcp.toolManagerConfig.toolExecutionTimeout for this server only. Omit or set to 0 to use the global default." }, "isPingAvailable": { "type": "boolean", "description": "Whether the MCP server supports ping" }, "toolPricing": { "type": "object", "description": "Tool pricing map (tool name to cost per execution)", "additionalProperties": { "type": "number", "minimum": 0 } }, "allowedExtraHeaders": { "type": "array", "items": { "type": "string" }, "description": "Allowlist of request-level headers that callers may forward to this MCP server. Use ['*'] to allow all headers." }, "allowOnAllVirtualKeys": { "type": "boolean", "description": "When true, this MCP server is accessible to all virtual keys without requiring explicit per-key assignment.", "default": false }, "tlsConfig": { "type": "object", "description": "[Upcoming] TLS configuration for HTTP and SSE connection types. Not applicable to stdio or inprocess.", "properties": { "insecureSkipVerify": { "type": "boolean", "description": "Disable TLS certificate verification. Takes priority over caCertPem. Development/testing only.", "default": false }, "caCertPem": { "type": "string", "description": "PEM-encoded CA certificate for MCP server connections. Accepts a literal PEM string or an env.VAR_NAME reference." } }, "additionalProperties": false } }, "required": ["name", "connectionType"], "allOf": [ { "if": { "properties": { "connectionType": { "const": "stdio" } } }, "then": { "required": ["stdioConfig"] } }, { "if": { "properties": { "connectionType": { "const": "websocket" } } }, "then": { "required": ["websocketConfig"] } }, { "if": { "properties": { "connectionType": { "const": "http" } } }, "then": { "required": ["httpConfig"] } }, { "if": { "properties": { "connectionType": { "const": "sse" } } }, "then": { "required": ["connectionString"] } } ] }, "mcpToolGroupConfig": { "type": "object", "properties": { "name": { "type": "string", "description": "Tool group name" }, "description": { "type": "string", "description": "Tool group description" }, "enabled": { "type": "boolean", "description": "Whether tool group is enabled", "default": true }, "tools": { "type": "array", "minItems": 1, "description": "MCP tools included in this group", "items": { "type": "object", "properties": { "mcpClientId": { "type": "string", "description": "MCP client ID" }, "mcpClientName": { "type": "string", "description": "MCP client name (resolved to client_id at startup)" }, "toolNames": { "type": "array", "description": "Tool names to allow. Empty means all tools from this MCP client.", "items": { "type": "string" } } }, "oneOf": [ { "required": ["mcpClientId"] }, { "required": ["mcpClientName"] } ], "additionalProperties": false } }, "virtualKeyIds": { "type": "array", "items": { "type": "string" } }, "teamIds": { "type": "array", "items": { "type": "string" } }, "customerIds": { "type": "array", "items": { "type": "string" } }, "userIds": { "type": "array", "items": { "type": "string" } }, "providerNames": { "type": "array", "items": { "type": "string" } }, "apiKeyIds": { "type": "array", "items": { "type": "integer" } } }, "required": ["name", "tools"], "additionalProperties": false }, "virtualKeyProviderConfig": { "type": "object", "description": "Provider configuration for a virtual key", "properties": { "id": { "type": "integer", "description": "Provider config ID" }, "virtual_key_id": { "type": "string", "description": "Associated virtual key ID" }, "provider": { "type": "string", "description": "Provider name" }, "weight": { "type": "number", "description": "Weight for load balancing", "default": 1.0 }, "allowed_models": { "type": "array", "description": "Allowed models for this provider config. Use [\"*\"] to allow all models; empty array denies all (deny-by-default).", "items": { "type": "string" } }, "blacklisted_models": { "type": "array", "description": "Models blocked for this provider config even if matched by allowed_models. Use [\"*\"] to block all.", "items": { "type": "string" } }, "budget_id": { "type": "string", "description": "Associated budget ID" }, "rate_limit_id": { "type": "string", "description": "Associated rate limit ID" }, "key_ids": { "type": "array", "description": "Key identifiers allowed for this provider config. Use [\"*\"] to allow all keys; empty array denies all (deny-by-default).", "items": { "type": "string" } }, "keys": { "type": "array", "description": "Provider keys for this config (empty means all keys allowed for this provider)", "items": { "type": "object", "properties": { "id": { "type": "integer", "description": "Key database ID (auto-generated)" }, "key_id": { "type": "string", "description": "Key UUID identifier" }, "name": { "type": "string", "description": "Key name (must be unique)" }, "value": { "type": "string", "description": "API key value (can use env. prefix)" }, "models": { "type": "array", "items": { "type": "string" }, "description": "Models this key can access. Use [\"*\"] to allow all models; empty array denies all (deny-by-default)." }, "weight": { "type": "number", "minimum": 0, "default": 1.0, "description": "Weight for load balancing" }, "azure_key_config": { "type": "object", "properties": { "endpoint": { "type": "string", "description": "Azure endpoint (can use env. prefix)" }, "client_id": { "type": "string", "description": "Azure client ID for authentication (can use env. prefix)" }, "client_secret": { "type": "string", "description": "Azure client secret for authentication (can use env. prefix)" }, "tenant_id": { "type": "string", "description": "Azure tenant ID for authentication (can use env. prefix)" }, "scopes": { "type": "array", "items": { "type": "string" }, "description": "Azure scopes for authentication" }, "deployments": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Model to deployment mappings" }, "api_version": { "type": "string", "description": "Azure API version" } }, "dependentRequired": { "client_id": ["client_secret", "tenant_id"], "client_secret": ["client_id", "tenant_id"], "tenant_id": ["client_id", "client_secret"] }, "additionalProperties": false }, "vertex_key_config": { "type": "object", "properties": { "project_id": { "type": "string", "description": "Google Cloud project ID (can use env. prefix)" }, "project_number": { "type": "string", "description": "Google Cloud project number" }, "region": { "type": "string", "description": "Google Cloud region" }, "auth_credentials": { "type": "string", "description": "Authentication credentials (can use env. prefix)" }, "deployments": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Model to deployment mappings" } }, "additionalProperties": false }, "bedrock_key_config": { "type": "object", "properties": { "access_key": { "type": "string", "description": "AWS access key (can use env. prefix)" }, "secret_key": { "type": "string", "description": "AWS secret key (can use env. prefix)" }, "session_token": { "type": "string", "description": "AWS session token (can use env. prefix)" }, "region": { "type": "string", "description": "AWS region" }, "arn": { "type": "string", "description": "AWS ARN" }, "role_arn": { "type": "string", "description": "AWS IAM role ARN for AssumeRole (can use env. prefix)" }, "external_id": { "type": "string", "description": "External ID for AssumeRole (can use env. prefix)" }, "session_name": { "type": "string", "description": "Role session name for AssumeRole (can use env. prefix)" }, "deployments": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Model to deployment mappings" }, "batch_s3_config": { "type": "object", "description": "S3 bucket configuration for Bedrock batch operations", "properties": { "buckets": { "type": "array", "description": "List of S3 bucket configurations", "items": { "type": "object", "properties": { "bucket_name": { "type": "string", "description": "S3 bucket name" }, "prefix": { "type": "string", "description": "S3 key prefix for batch files" }, "is_default": { "type": "boolean", "description": "Whether this is the default bucket for batch operations" } }, "required": ["bucket_name"], "additionalProperties": false } } } } }, "additionalProperties": false }, "vllm_key_config": { "type": "object", "properties": { "url": { "type": "string", "description": "VLLM server base URL (can use env. prefix)" }, "model_name": { "type": "string", "description": "Exact model name served on this VLLM instance" } }, "additionalProperties": false } }, "oneOf": [ { "not": { "anyOf": [ { "required": ["azure_key_config"] }, { "required": ["vertex_key_config"] }, { "required": ["bedrock_key_config"] }, { "required": ["vllm_key_config"] } ] } }, { "required": ["azure_key_config"], "not": { "anyOf": [ { "required": ["vertex_key_config"] }, { "required": ["bedrock_key_config"] }, { "required": ["vllm_key_config"] } ] } }, { "required": ["vertex_key_config"], "not": { "anyOf": [ { "required": ["azure_key_config"] }, { "required": ["bedrock_key_config"] }, { "required": ["vllm_key_config"] } ] } }, { "required": ["bedrock_key_config"], "not": { "anyOf": [ { "required": ["azure_key_config"] }, { "required": ["vertex_key_config"] }, { "required": ["vllm_key_config"] } ] } }, { "required": ["vllm_key_config"], "not": { "anyOf": [ { "required": ["azure_key_config"] }, { "required": ["vertex_key_config"] }, { "required": ["bedrock_key_config"] } ] } } ] } } }, "required": ["provider"], "additionalProperties": false }, "scim_attribute_role_mappings": { "type": "array", "description": "Ordered list of attribute -> role mappings (first match wins).", "items": { "type": "object", "properties": { "attribute": { "type": "string", "description": "JWT claim name (supports dot paths, e.g. 'realm_access.roles')" }, "value": { "type": "string", "description": "Claim value to match (case-insensitive)" }, "role": { "type": "string", "description": "Bifrost role to assign on match" } }, "required": ["attribute", "value", "role"], "additionalProperties": false } }, "scim_attribute_team_mappings": { "type": "array", "description": "Attribute -> team mappings (all matches apply). Use value '*' for pass-through.", "items": { "type": "object", "properties": { "attribute": { "type": "string", "description": "JWT claim name" }, "value": { "type": "string", "description": "Claim value to match, or '*' for pass-through" }, "team": { "type": "string", "description": "Bifrost team slug to assign. In case of '*' value, leave this empty" } }, "required": ["attribute", "value"], "additionalProperties": false } }, "scim_attribute_business_unit_mappings": { "type": "array", "description": "Attribute -> business-unit mappings (all matches apply).", "items": { "type": "object", "properties": { "attribute": { "type": "string", "description": "JWT claim name" }, "value": { "type": "string", "description": "Claim value to match. Wildcard '*' will use the claim as the name of the business unit to assign." }, "business_unit": { "type": "string", "description": "Bifrost business unit slug to assign. In case of '*' value, leave this empty" } }, "required": ["attribute", "value"], "additionalProperties": false } }, "scim_claim_attributes": { "type": "object", "description": "Per-claim SCIM interpretation. Maps each claim name to its SCIM source type and attribute key. Set by the UI when SCIM provisioning is configured.", "additionalProperties": { "type": "object", "properties": { "attributeType": { "type": "string", "enum": ["user", "group"], "description": "'user' reads from SCIM User resource attributes; 'group' matches SCIM Group resource." }, "attributeValue": { "type": "string", "description": "SCIM attribute key or group match field for this claim." } }, "required": ["attributeType", "attributeValue"], "additionalProperties": false } } } }