5938 lines
212 KiB
JSON
5938 lines
212 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2019-09/schema",
|
|
"title": "Bifrost Helm Chart Values",
|
|
"description": "Schema for Bifrost Helm chart values.yaml",
|
|
"type": "object",
|
|
"properties": {
|
|
"replicaCount": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Number of Bifrost replicas"
|
|
},
|
|
"image": {
|
|
"type": "object",
|
|
"properties": {
|
|
"repository": {
|
|
"type": "string",
|
|
"description": "Container image repository"
|
|
},
|
|
"pullPolicy": {
|
|
"type": "string",
|
|
"enum": ["Always", "IfNotPresent", "Never"],
|
|
"description": "Image pull policy"
|
|
},
|
|
"tag": {
|
|
"type": "string",
|
|
"description": "Image tag (required - validated at template render time)"
|
|
}
|
|
}
|
|
},
|
|
"imagePullSecrets": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object"
|
|
}
|
|
},
|
|
"nameOverride": {
|
|
"type": "string"
|
|
},
|
|
"fullnameOverride": {
|
|
"type": "string"
|
|
},
|
|
"serviceAccount": {
|
|
"type": "object",
|
|
"properties": {
|
|
"create": {
|
|
"type": "boolean"
|
|
},
|
|
"automount": {
|
|
"type": "boolean"
|
|
},
|
|
"annotations": {
|
|
"type": "object"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"rbac": {
|
|
"type": "object",
|
|
"properties": {
|
|
"podDiscovery": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Create namespaced Role/RoleBinding for Kubernetes pod discovery when cluster discovery type is kubernetes"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"deploymentAnnotations": {
|
|
"type": "object"
|
|
},
|
|
"deploymentLabels": {
|
|
"type": "object"
|
|
},
|
|
"podAnnotations": {
|
|
"type": "object"
|
|
},
|
|
"podLabels": {
|
|
"type": "object"
|
|
},
|
|
"podSecurityContext": {
|
|
"type": "object"
|
|
},
|
|
"securityContext": {
|
|
"type": "object"
|
|
},
|
|
"service": {
|
|
"type": "object",
|
|
"properties": {
|
|
"type": {
|
|
"type": "string",
|
|
"enum": ["ClusterIP", "NodePort", "LoadBalancer"]
|
|
},
|
|
"port": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 65535
|
|
},
|
|
"annotations": {
|
|
"type": "object"
|
|
}
|
|
}
|
|
},
|
|
"ingress": {
|
|
"description": "Ingress configuration. Either a single ingress (legacy, with top-level 'enabled') or a map of named ingresses (new format, each key becomes a separate Ingress resource named <release>-<key>).",
|
|
"oneOf": [
|
|
{
|
|
"type": "object",
|
|
"description": "Single ingress (legacy format).",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"className": {
|
|
"type": "string"
|
|
},
|
|
"ingressClassName": {
|
|
"type": "string",
|
|
"description": "Meesho Contour ingress class used by the retained HTTPProxy templates"
|
|
},
|
|
"servicePortNumber": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 65535
|
|
},
|
|
"enableWebsocket": {
|
|
"type": "boolean"
|
|
},
|
|
"slowStart": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"window": { "type": ["string", "integer"] },
|
|
"aggression": { "type": "number" },
|
|
"minPercent": { "type": "integer", "minimum": 0, "maximum": 100 }
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"annotations": {
|
|
"type": "object"
|
|
},
|
|
"hosts": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"required": ["host", "paths"],
|
|
"properties": {
|
|
"host": {
|
|
"type": "string"
|
|
},
|
|
"paths": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"required": ["path", "pathType"],
|
|
"properties": {
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"pathType": {
|
|
"type": "string",
|
|
"enum": ["Prefix", "Exact", "ImplementationSpecific"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"tls": {
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": ["enabled"]
|
|
},
|
|
{
|
|
"type": "object",
|
|
"description": "Named ingresses map. Each key produces a separate Ingress named <release>-<key>. Keys must be valid DNS-1123 label segments (lowercase alphanumeric and hyphens only, no underscores or uppercase) so the resulting Ingress name is a valid Kubernetes resource name.",
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"className": {
|
|
"type": "string"
|
|
},
|
|
"annotations": {
|
|
"type": "object"
|
|
},
|
|
"hosts": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"required": ["host", "paths"],
|
|
"properties": {
|
|
"host": {
|
|
"type": "string"
|
|
},
|
|
"paths": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"required": ["path", "pathType"],
|
|
"properties": {
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"pathType": {
|
|
"type": "string",
|
|
"enum": ["Prefix", "Exact", "ImplementationSpecific"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"tls": {
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": ["enabled"]
|
|
},
|
|
"not": {
|
|
"required": ["enabled"]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"httpProxy": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": { "type": "boolean" }
|
|
},
|
|
"additionalProperties": true
|
|
},
|
|
"createContourGateway": {
|
|
"type": "boolean"
|
|
},
|
|
"namespace": {
|
|
"type": "string"
|
|
},
|
|
"contourResponseTimeout": {
|
|
"type": ["boolean", "string"]
|
|
},
|
|
"podDisruptionBudget": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"maxUnavailable": { "type": ["string", "integer"] },
|
|
"minAvailable": { "type": ["string", "integer"] }
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"externalSecret": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"secretName": { "type": "string" },
|
|
"path": { "type": "string" },
|
|
"version": { "type": "string" },
|
|
"refreshInterval": { "type": "string" },
|
|
"secretStoreRef": { "type": "string" }
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"keda": {
|
|
"type": "object"
|
|
},
|
|
"resources": {
|
|
"type": "object",
|
|
"properties": {
|
|
"limits": {
|
|
"type": "object"
|
|
},
|
|
"requests": {
|
|
"type": "object"
|
|
}
|
|
}
|
|
},
|
|
"livenessProbe": {
|
|
"type": "object"
|
|
},
|
|
"readinessProbe": {
|
|
"type": "object"
|
|
},
|
|
"autoscaling": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"minReplicas": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"maxReplicas": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"targetCPUUtilizationPercentage": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 100
|
|
},
|
|
"targetMemoryUtilizationPercentage": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 100
|
|
}
|
|
}
|
|
},
|
|
"volumes": {
|
|
"type": "array"
|
|
},
|
|
"volumeMounts": {
|
|
"type": "array"
|
|
},
|
|
"nodeSelector": {
|
|
"type": "object"
|
|
},
|
|
"tolerations": {
|
|
"type": "array"
|
|
},
|
|
"affinity": {
|
|
"type": "object"
|
|
},
|
|
"strategy": {
|
|
"type": "object",
|
|
"description": "Deployment update strategy. Applies to the Deployment only (not the StatefulSet). Empty uses the Kubernetes default. Rendered verbatim into spec.strategy."
|
|
},
|
|
"bifrost": {
|
|
"type": "object",
|
|
"description": "Bifrost application configuration",
|
|
"properties": {
|
|
"appDir": {
|
|
"type": "string",
|
|
"description": "Application data directory"
|
|
},
|
|
"port": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 65535
|
|
},
|
|
"host": {
|
|
"type": "string"
|
|
},
|
|
"logLevel": {
|
|
"type": "string",
|
|
"enum": ["debug", "info", "warn", "error"]
|
|
},
|
|
"logStyle": {
|
|
"type": "string",
|
|
"enum": ["json", "text"]
|
|
},
|
|
"envLabel": {
|
|
"type": "string",
|
|
"description": "Short label (max 10 characters) displayed in the management UI sidebar to identify the environment (e.g. \"staging\", \"prod\"). Written into config.json as env_label.",
|
|
"maxLength": 10
|
|
},
|
|
"sourceOfTruth": {
|
|
"type": "string",
|
|
"enum": ["split", "config.json"],
|
|
"default": "split",
|
|
"description": "Controls how config.json is reconciled with the database on startup. \"split\" (default) preserves existing merge behavior. \"config.json\" makes explicitly-present sections in the file authoritative — database-only rows for those sections are pruned on startup."
|
|
},
|
|
"encryptionKey": {
|
|
"type": "string",
|
|
"description": "Encryption key for sensitive data. If not set, encryption is disabled and data is stored in plaintext."
|
|
},
|
|
"encryptionKeySecret": {
|
|
"type": "object",
|
|
"description": "Reference to an existing Kubernetes secret holding the encryption key. Takes precedence over `encryptionKey` when `name` is set.",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"key": {
|
|
"type": "string",
|
|
"default": "encryption-key"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"authConfig": {
|
|
"$ref": "#/$defs/authConfig"
|
|
},
|
|
"client": {
|
|
"type": "object",
|
|
"description": "Client configuration settings",
|
|
"properties": {
|
|
"dropExcessRequests": {
|
|
"type": "boolean",
|
|
"description": "Whether to drop excess requests when pool is full"
|
|
},
|
|
"initialPoolSize": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Initial size of the connection pool",
|
|
"default": 300
|
|
},
|
|
"allowedOrigins": {
|
|
"type": "array",
|
|
"items": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string",
|
|
"const": "*"
|
|
},
|
|
{
|
|
"type": "string",
|
|
"format": "uri"
|
|
}
|
|
]
|
|
},
|
|
"description": "CORS allowed origins (supports \"*\" or URI strings)"
|
|
},
|
|
"enableLogging": {
|
|
"type": "boolean",
|
|
"description": "Enable request/response logging"
|
|
},
|
|
"disableContentLogging": {
|
|
"type": "boolean",
|
|
"description": "Disable logging of sensitive content (inputs, outputs, embeddings, etc.)"
|
|
},
|
|
"allowPerRequestContentStorageOverride": {
|
|
"type": "boolean",
|
|
"description": "Allow individual requests to override content storage via the x-bf-disable-content-logging header or context key, and to opt in to raw-byte persistence in logs via x-bf-store-raw-request-response. When false (default), the global disable_content_logging setting is authoritative and per-request storage overrides are ignored. Does not control sending raw bytes back to callers.",
|
|
"default": false
|
|
},
|
|
"allowPerRequestRawOverride": {
|
|
"type": "boolean",
|
|
"description": "Allow individual requests to send raw provider request/response bytes back to the caller via the x-bf-send-back-raw-request and x-bf-send-back-raw-response headers. When false (default), the provider-level send_back_raw_request/response settings are authoritative and per-request overrides are ignored. Does not affect raw-byte persistence in logs.",
|
|
"default": false
|
|
},
|
|
"disableDbPingsInHealth": {
|
|
"type": "boolean",
|
|
"description": "Disable DB pings in health check",
|
|
"default": false
|
|
},
|
|
"dumpErrorsInConsoleLogs": {
|
|
"type": "boolean",
|
|
"description": "Dump full error details to the server console logs. Useful for debugging; may be noisy in production.",
|
|
"default": false
|
|
},
|
|
"logRetentionDays": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Number of days to retain logs",
|
|
"default": 365
|
|
},
|
|
"enforceGovernanceHeader": {
|
|
"type": "boolean",
|
|
"description": "Deprecated: use enforceAuthOnInference"
|
|
},
|
|
"maxRequestBodySizeMb": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Maximum request body size in MB"
|
|
},
|
|
"compat": {
|
|
"type": "object",
|
|
"description": "Compat plugin configuration for request type conversion, parameter dropping, and parameter value conversion",
|
|
"properties": {
|
|
"convertTextToChat": {
|
|
"type": "boolean",
|
|
"description": "Convert text completion requests to chat for models that only support chat"
|
|
},
|
|
"convertChatToResponses": {
|
|
"type": "boolean",
|
|
"description": "Convert chat completion requests to responses for models that only support responses"
|
|
},
|
|
"shouldDropParams": {
|
|
"type": "boolean",
|
|
"description": "Drop unsupported parameters based on model catalog allowlist"
|
|
},
|
|
"shouldConvertParams": {
|
|
"type": "boolean",
|
|
"description": "Converts model parameter values that are not supported by the model."
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"prometheusLabels": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Labels to use for Prometheus metrics"
|
|
},
|
|
"headerFilterConfig": {
|
|
"type": "object",
|
|
"description": "Global header filtering configuration for x-bf-eh-* headers forwarded to LLM providers",
|
|
"properties": {
|
|
"allowlist": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "If non-empty, only these headers (from x-bf-eh-* prefix) are allowed to be forwarded"
|
|
},
|
|
"denylist": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Headers to always block from being forwarded"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"enforceAuthOnInference": {
|
|
"type": "boolean",
|
|
"description": "Require auth (VK, API key, or user token) on inference endpoints"
|
|
},
|
|
"enableLitellmFallbacks": {
|
|
"type": "boolean",
|
|
"deprecated": true,
|
|
"description": "Deprecated compatibility key accepted for existing Meesho overrides; ignored by Bifrost 1.5.x"
|
|
},
|
|
"enforceSCIMAuth": {
|
|
"type": "boolean",
|
|
"description": "Deprecated: use enforceAuthOnInference"
|
|
},
|
|
"allowedHeaders": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Additional allowed headers for CORS and WebSocket"
|
|
},
|
|
"mcpAgentDepth": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "DEPRECATED: Maximum depth for MCP agent mode tool execution. Use bifrost.mcp.toolManagerConfig.maxAgentDepth.",
|
|
"default": 10
|
|
},
|
|
"mcpToolExecutionTimeout": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "DEPRECATED: Timeout for individual MCP tool execution in seconds. Use bifrost.mcp.toolManagerConfig.toolExecutionTimeout.",
|
|
"default": 30
|
|
},
|
|
"mcpCodeModeBindingLevel": {
|
|
"type": "string",
|
|
"enum": ["server", "tool"],
|
|
"description": "DEPRECATED: Code mode binding level for MCP tools. Use bifrost.mcp.toolManagerConfig.codeModeBindingLevel."
|
|
},
|
|
"mcpToolSyncInterval": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"description": "DEPRECATED: Global tool sync interval in minutes (0 = disabled). Use bifrost.mcp.toolSyncInterval."
|
|
},
|
|
"asyncJobResultTTL": {
|
|
"type": "integer",
|
|
"description": "Default TTL for async job results in seconds (default: 3600 = 1 hour)",
|
|
"default": 3600,
|
|
"minimum": 1
|
|
},
|
|
"requiredHeaders": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Headers that must be present on every request. Requests missing any of these headers are rejected with 400. Case-insensitive matching."
|
|
},
|
|
"loggingHeaders": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Headers to capture in log metadata. Values are extracted from incoming requests and stored in the metadata field of log entries."
|
|
},
|
|
"whitelistedRoutes": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Routes that bypass auth middleware. Requests to these exact paths skip authentication checks."
|
|
},
|
|
"hideDeletedVirtualKeysInFilters": {
|
|
"type": "boolean",
|
|
"description": "When true, deleted virtual keys are omitted from logs and MCP logs filter data.",
|
|
"default": false
|
|
},
|
|
"mcpDisableAutoToolInject": {
|
|
"type": "boolean",
|
|
"description": "DEPRECATED: When true, MCP tools are not automatically injected into requests. Use bifrost.mcp.toolManagerConfig.disableAutoToolInject.",
|
|
"default": false
|
|
},
|
|
"mcpEnableTempTokenAuth": {
|
|
"type": "boolean",
|
|
"description": "When true, Bifrost mints and accepts scoped temp tokens for MCP per-user OAuth auth pages.",
|
|
"default": false
|
|
},
|
|
"routingChainMaxDepth": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Maximum depth for routing rule chain evaluation",
|
|
"default": 10
|
|
},
|
|
"allowDirectKeys": {
|
|
"type": "boolean",
|
|
"description": "Allow callers to bypass the registered key pool by supplying x-bf-direct-key: true with an Authorization header carrying the provider key. Maps to client.allow_direct_keys.",
|
|
"default": false
|
|
},
|
|
"mcpExternalClientUrl": {
|
|
"type": "string",
|
|
"description": "Public base URL Bifrost uses as the redirect_uri when acting as an OAuth client to upstream MCP servers. Maps to client.mcp_external_client_url."
|
|
},
|
|
"mcpServerAuthMode": {
|
|
"type": "string",
|
|
"enum": ["headers", "both", "oauth"],
|
|
"description": "How /mcp authenticates inbound MCP clients. 'headers' (default): VK/api-key/session headers only, discovery disabled. 'both': accepts header credentials and Bifrost-issued JWTs, discovery enabled. 'oauth': Bifrost JWTs only. Maps to client.mcp_server_auth_mode."
|
|
},
|
|
"oauth2ServerConfig": {
|
|
"type": "object",
|
|
"description": "OAuth2 authorization server settings for /mcp. Only relevant when mcpServerAuthMode is 'both' or 'oauth'. Maps to client.oauth2_server_config.",
|
|
"properties": {
|
|
"issuerUrl": {
|
|
"type": "string",
|
|
"description": "Stable public URL advertised as the OAuth2 AS issuer in discovery documents and JWT iss claim. Required for multi-host deployments. Supports env var syntax: \"env.MY_VAR\"."
|
|
},
|
|
"authCodeTtl": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 900,
|
|
"description": "Lifetime of the single-use authorization code in seconds (default: 300, max: 900)."
|
|
},
|
|
"accessTokenTtl": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Lifetime of the issued JWT Bearer token in seconds (default: 600)."
|
|
},
|
|
"disableVkIdentity": {
|
|
"type": "boolean",
|
|
"description": "When true, the OAuth consent flow no longer offers or accepts virtual-key identity. Honored only when an identity provider is configured. Only valid when mcpServerAuthMode is 'oauth'."
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"server": {
|
|
"type": "object",
|
|
"description": "HTTP server configuration",
|
|
"properties": {
|
|
"readBufferSize": {
|
|
"type": "integer",
|
|
"description": "Read buffer size in bytes. This controls the size of the buffer used for reading HTTP headers.",
|
|
"default": 65536
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"framework": {
|
|
"type": "object",
|
|
"properties": {
|
|
"pricing": {
|
|
"type": "object",
|
|
"properties": {
|
|
"pricingUrl": {
|
|
"type": "string",
|
|
"description": "Custom pricing URL (optional, can be empty)"
|
|
},
|
|
"modelParametersUrl": {
|
|
"type": "string",
|
|
"description": "Custom model parameters URL (optional, can be empty)"
|
|
},
|
|
"pricingSyncInterval": {
|
|
"type": "integer",
|
|
"description": "Pricing sync interval in seconds. Default is 24 hours. Minimum is 3600 seconds (1 hour).",
|
|
"default": 86400,
|
|
"minimum": 3600
|
|
},
|
|
"mcpLibraryUrl": {
|
|
"description": "URL to a custom MCP server catalog. Leave empty to use the default Bifrost catalog.",
|
|
"anyOf": [
|
|
{"type": "string", "format": "uri"},
|
|
{"const": ""}
|
|
]
|
|
},
|
|
"mcpLibrarySyncInterval": {
|
|
"type": "integer",
|
|
"description": "MCP library sync interval in seconds. Default is 24 hours. Minimum is 3600 seconds (1 hour).",
|
|
"default": 86400,
|
|
"minimum": 3600
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"providers": {
|
|
"type": "object",
|
|
"description": "AI provider configurations",
|
|
"additionalProperties": {
|
|
"$ref": "#/$defs/provider"
|
|
}
|
|
},
|
|
"providerSecrets": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"properties": {
|
|
"existingSecret": {
|
|
"type": "string"
|
|
},
|
|
"key": {
|
|
"type": "string"
|
|
},
|
|
"envVar": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"mcp": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"clientConfigs": {
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/$defs/mcpClientConfig"
|
|
},
|
|
"description": "MCP client configurations"
|
|
},
|
|
"toolManagerConfig": {
|
|
"type": "object",
|
|
"properties": {
|
|
"toolExecutionTimeout": {
|
|
"type": ["integer", "string"],
|
|
"description": "Tool execution timeout. Integer = seconds (e.g. 30), string = Go duration (e.g. \"30s\", \"2m\"). Prefer the string form.",
|
|
"default": "30s"
|
|
},
|
|
"maxAgentDepth": {
|
|
"type": "integer",
|
|
"description": "Max agent depth",
|
|
"minimum": 1,
|
|
"default": 10
|
|
},
|
|
"codeModeBindingLevel": {
|
|
"type": "string",
|
|
"enum": ["server", "tool"],
|
|
"description": "How tools are exposed in VFS for code execution"
|
|
},
|
|
"disableAutoToolInject": {
|
|
"type": "boolean",
|
|
"description": "When true, MCP tools are not automatically injected into requests. Tools are only included when explicitly specified via request context filters or headers, such as x-bf-mcp-include-tools or x-bf-mcp-include-clients.",
|
|
"default": false
|
|
}
|
|
}
|
|
},
|
|
"toolSyncInterval": {
|
|
"description": "Global default interval for syncing tools from MCP servers (Go duration string, e.g. '10m', '1h', '0s' to use runtime default). Legacy numeric nanoseconds are also supported for backward compatibility.",
|
|
"oneOf": [
|
|
{
|
|
"type": "string",
|
|
"pattern": "^-?(?:\\d+(?:\\.\\d+)?(?:ns|us|\u00b5s|ms|s|m|h))+$"
|
|
},
|
|
{
|
|
"type": "integer"
|
|
}
|
|
]
|
|
},
|
|
"toolGroups": {
|
|
"type": "array",
|
|
"description": "Enterprise MCP tool groups with optional governance associations",
|
|
"items": {
|
|
"$ref": "#/$defs/mcpToolGroupConfig"
|
|
}
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"description": "Model Context Protocol configuration"
|
|
},
|
|
"plugins": {
|
|
"type": "object",
|
|
"properties": {
|
|
"telemetry": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"custom_labels": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Custom labels to add to all metrics"
|
|
},
|
|
"push_gateway": {
|
|
"type": "object",
|
|
"description": "Configuration for pushing metrics to a Prometheus Push Gateway for multi-node cluster deployments",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether to enable pushing metrics to the Push Gateway",
|
|
"default": false
|
|
},
|
|
"push_gateway_url": {
|
|
"type": "string",
|
|
"description": "URL of the Prometheus Push Gateway (e.g., http://pushgateway:9091)",
|
|
"format": "uri"
|
|
},
|
|
"job_name": {
|
|
"type": "string",
|
|
"description": "Job label for pushed metrics",
|
|
"default": "bifrost"
|
|
},
|
|
"instance_id": {
|
|
"type": "string",
|
|
"description": "Instance identifier for grouping metrics. If not set, hostname is used automatically."
|
|
},
|
|
"push_interval": {
|
|
"type": "integer",
|
|
"description": "How often to push metrics in seconds",
|
|
"default": 15,
|
|
"minimum": 1,
|
|
"maximum": 300
|
|
},
|
|
"basic_auth": {
|
|
"type": "object",
|
|
"description": "Basic authentication credentials for the Push Gateway",
|
|
"properties": {
|
|
"username": {
|
|
"type": "string",
|
|
"description": "Username for basic authentication"
|
|
},
|
|
"password": {
|
|
"type": "string",
|
|
"description": "Password for basic authentication"
|
|
}
|
|
},
|
|
"required": ["username", "password"]
|
|
}
|
|
},
|
|
"required": ["push_gateway_url"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"logging": {
|
|
"$ref": "#/$defs/pluginBase"
|
|
},
|
|
"governance": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"is_vk_mandatory": {
|
|
"type": "boolean"
|
|
},
|
|
"required_headers": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Headers that must be present in requests"
|
|
},
|
|
"is_enterprise": {
|
|
"type": "boolean",
|
|
"description": "Enable enterprise mode features"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"maxim": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"api_key": {
|
|
"type": "string"
|
|
},
|
|
"log_repo_id": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"secretRef": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"key": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"config": {
|
|
"required": ["api_key"]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"properties": {
|
|
"secretRef": {
|
|
"required": ["name"]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"semanticCache": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"provider": {
|
|
"type": "string",
|
|
"enum": [
|
|
"openai",
|
|
"anthropic",
|
|
"gemini",
|
|
"bedrock",
|
|
"azure",
|
|
"cohere",
|
|
"mistral",
|
|
"groq",
|
|
"ollama",
|
|
"openrouter",
|
|
"vertex",
|
|
"cerebras",
|
|
"deepseek",
|
|
"parasail",
|
|
"perplexity",
|
|
"sgl",
|
|
"huggingface"
|
|
]
|
|
},
|
|
"keys": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "API keys for embedding provider (required for semantic caching, not needed for direct caching with dimension: 1)"
|
|
},
|
|
"embedding_model": {
|
|
"type": "string"
|
|
},
|
|
"dimension": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"threshold": {
|
|
"type": "number",
|
|
"minimum": 0,
|
|
"maximum": 1
|
|
},
|
|
"ttl": {
|
|
"description": "Time-to-live for cached responses (supports duration strings like '5m', '1h' or seconds as number, default: 5min)",
|
|
"oneOf": [
|
|
{
|
|
"type": "string",
|
|
"pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$"
|
|
},
|
|
{
|
|
"type": "integer",
|
|
"minimum": 0
|
|
}
|
|
]
|
|
},
|
|
"conversation_history_threshold": {
|
|
"type": "integer",
|
|
"minimum": 0
|
|
},
|
|
"cache_by_model": {
|
|
"type": "boolean"
|
|
},
|
|
"cache_by_provider": {
|
|
"type": "boolean"
|
|
},
|
|
"exclude_system_prompt": {
|
|
"type": "boolean"
|
|
},
|
|
"vector_store_namespace": {
|
|
"type": "string"
|
|
},
|
|
"default_cache_key": {
|
|
"type": "string",
|
|
"description": "Default cache key for semantic cache lookups"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"config": {
|
|
"required": ["dimension"]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"otel": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"config": {
|
|
"anyOf": [
|
|
{ "$ref": "#/$defs/otelProfileConfig" },
|
|
{ "$ref": "#/$defs/otelProfilesConfig" }
|
|
],
|
|
"description": "Configuration for the OpenTelemetry plugin. Supports the legacy single-profile shape or the profiles wrapper for multiple collectors."
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"config": {
|
|
"anyOf": [
|
|
{ "$ref": "#/$defs/otelProfileConfig" },
|
|
{ "$ref": "#/$defs/otelProfilesConfig" }
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"datadog": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"version": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"service_name": {
|
|
"type": "string"
|
|
},
|
|
"ml_app": {
|
|
"type": "string",
|
|
"description": "ML application name for Datadog LLM Observability grouping (defaults to service_name)"
|
|
},
|
|
"agent_addr": {
|
|
"type": "string",
|
|
"description": "Datadog Agent address for APM traces as combined host:port (agent mode only). Supports env.VAR_NAME prefix for environment variable substitution (e.g. env.DD_AGENT_ADDR). Overridden by agent_host when set"
|
|
},
|
|
"agent_host": {
|
|
"type": "string",
|
|
"description": "Datadog Agent host for APM traces, set separately from the port (agent mode only). Supports env.VAR_NAME prefix (e.g. env.DD_AGENT_HOST). Takes precedence over agent_addr. Useful in Kubernetes where the host is injected via the downward API (status.hostIP)"
|
|
},
|
|
"agent_port": {
|
|
"type": "string",
|
|
"description": "Datadog Agent port for APM traces, used with agent_host (agent mode only). Supports env.VAR_NAME prefix. Defaults to 8126; has no effect when agent_host is unset"
|
|
},
|
|
"dogstatsd_addr": {
|
|
"type": "string",
|
|
"description": "DogStatsD server address for metrics as combined host:port (agent mode only). Supports env.VAR_NAME prefix for environment variable substitution (e.g. env.DD_DOGSTATSD_ADDR). Overridden by dogstatsd_host when set"
|
|
},
|
|
"dogstatsd_host": {
|
|
"type": "string",
|
|
"description": "DogStatsD server host for metrics, set separately from the port (agent mode only). Supports env.VAR_NAME prefix (e.g. env.DD_DOGSTATSD_HOST). Takes precedence over dogstatsd_addr. Useful in Kubernetes where the host is injected via the downward API (status.hostIP)"
|
|
},
|
|
"dogstatsd_port": {
|
|
"type": "string",
|
|
"description": "DogStatsD server port for metrics, used with dogstatsd_host (agent mode only). Supports env.VAR_NAME prefix. Defaults to 8125; has no effect when dogstatsd_host is unset"
|
|
},
|
|
"env": {
|
|
"type": "string"
|
|
},
|
|
"version": {
|
|
"type": "string"
|
|
},
|
|
"custom_tags": {
|
|
"type": "object",
|
|
"description": "Custom tags for Datadog metrics and traces. Values support env.VAR_NAME prefix for environment variable substitution",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"enable_metrics": {
|
|
"type": "boolean",
|
|
"description": "Enable Datadog metrics emission (default: true)"
|
|
},
|
|
"enable_traces": {
|
|
"type": "boolean",
|
|
"description": "Enable Datadog APM traces (default: true)"
|
|
},
|
|
"enable_llm_obs": {
|
|
"type": "boolean",
|
|
"description": "Enable Datadog LLM Observability (default: true)"
|
|
},
|
|
"group_traces_by_session": {
|
|
"type": "boolean",
|
|
"description": "Group requests sharing the same x-bf-session-id header into a single APM trace, with each request as a top-level sibling span. Agent mode only; an inbound W3C traceparent takes precedence (default: false)"
|
|
},
|
|
"disable_content_logging": {
|
|
"type": "boolean",
|
|
"description": "When true, sensitive content (prompts, completions, embeddings) is excluded from traces (default: false)"
|
|
},
|
|
"agentless": {
|
|
"type": "boolean",
|
|
"description": "Use agentless mode to send data directly to Datadog APIs instead of a local agent. Requires api_key (default: false)"
|
|
},
|
|
"api_key": {
|
|
"type": "string",
|
|
"description": "Datadog API key, required for agentless mode. Supports env.VAR_NAME prefix for environment variable substitution (e.g. env.DD_API_KEY)"
|
|
},
|
|
"site": {
|
|
"type": "string",
|
|
"description": "Datadog site/region for agentless mode (e.g. datadoghq.com, datadoghq.eu)"
|
|
},
|
|
"request_headers": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Request header names to capture as Datadog span tags"
|
|
},
|
|
"plugin_span_filter": {
|
|
"$ref": "#/$defs/pluginSpanFilter"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"bigquery": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"version": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"project_id": {
|
|
"type": "string"
|
|
},
|
|
"dataset_id": {
|
|
"type": "string"
|
|
},
|
|
"table_id": {
|
|
"type": "string"
|
|
},
|
|
"location": {
|
|
"type": "string"
|
|
},
|
|
"service_account_key": {
|
|
"anyOf": [
|
|
{ "type": "string" },
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"value": { "type": "string" },
|
|
"env_var": { "type": "string" },
|
|
"from_env": { "type": "boolean" }
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
]
|
|
},
|
|
"create_table_if_not_exists": {
|
|
"type": "boolean"
|
|
},
|
|
"flush_interval_seconds": {
|
|
"type": "integer"
|
|
},
|
|
"buffer_size": {
|
|
"type": "integer"
|
|
},
|
|
"custom_labels": {
|
|
"type": "object"
|
|
},
|
|
"disable_content_logging": {
|
|
"type": "boolean"
|
|
},
|
|
"request_headers": {
|
|
"type": "array",
|
|
"items": { "type": "string" }
|
|
},
|
|
"plugin_span_filter": {
|
|
"$ref": "#/$defs/pluginSpanFilter"
|
|
}
|
|
},
|
|
"required": ["project_id"]
|
|
}
|
|
}
|
|
},
|
|
"kafka": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"version": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"brokers": {
|
|
"type": "array",
|
|
"items": { "type": "string" },
|
|
"description": "Kafka broker addresses (required when enabled)"
|
|
},
|
|
"topic": {
|
|
"type": "string",
|
|
"description": "Kafka topic to publish traces to (required when enabled)"
|
|
},
|
|
"sasl_enabled": {
|
|
"type": "boolean",
|
|
"description": "Enable SASL authentication. SASL is only activated when both sasl_enabled is true and sasl is set"
|
|
},
|
|
"sasl": {
|
|
"type": "object",
|
|
"properties": {
|
|
"mechanism": {
|
|
"type": "string",
|
|
"enum": ["PLAIN", "SCRAM-SHA-256", "SCRAM-SHA-512"]
|
|
},
|
|
"username": {
|
|
"anyOf": [
|
|
{ "type": "string" },
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"value": { "type": "string" },
|
|
"env_var": { "type": "string" },
|
|
"from_env": { "type": "boolean" }
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
],
|
|
"description": "SASL username. Supports env.VAR_NAME prefix for environment variable substitution"
|
|
},
|
|
"password": {
|
|
"anyOf": [
|
|
{ "type": "string" },
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"value": { "type": "string" },
|
|
"env_var": { "type": "string" },
|
|
"from_env": { "type": "boolean" }
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
],
|
|
"description": "SASL password. Supports env.VAR_NAME prefix for environment variable substitution"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"tls_enabled": {
|
|
"type": "boolean",
|
|
"description": "Enable TLS for broker connections"
|
|
},
|
|
"ca_cert": {
|
|
"anyOf": [
|
|
{ "type": "string" },
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"value": { "type": "string" },
|
|
"env_var": { "type": "string" },
|
|
"from_env": { "type": "boolean" }
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
],
|
|
"description": "PEM-encoded CA certificate used to verify the broker's TLS certificate. Omit to use the system CA pool. Supports env.VAR_NAME prefix"
|
|
},
|
|
"compression": {
|
|
"type": "string",
|
|
"enum": ["none", "gzip", "snappy", "lz4", "zstd"],
|
|
"description": "Compression codec for published messages"
|
|
},
|
|
"batch_size": {
|
|
"type": "integer",
|
|
"description": "Maximum number of messages batched per write (default: 100)"
|
|
},
|
|
"flush_interval_ms": {
|
|
"type": "integer",
|
|
"description": "Maximum time (ms) to wait before flushing a batch (default: 1000)"
|
|
},
|
|
"auto_create_topic": {
|
|
"type": "boolean",
|
|
"description": "Create the topic at startup if it does not exist"
|
|
},
|
|
"disable_content_logging": {
|
|
"type": "boolean",
|
|
"description": "Strip input/output message content from traces before publishing"
|
|
},
|
|
"request_headers": {
|
|
"type": "array",
|
|
"items": { "type": "string" },
|
|
"description": "Request-header name patterns (exact or wildcard like \"x-custom-*\") whose captured values are embedded in published traces"
|
|
},
|
|
"plugin_span_filter": {
|
|
"$ref": "#/$defs/pluginSpanFilter"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": { "const": true }
|
|
},
|
|
"required": ["enabled"]
|
|
},
|
|
"then": {
|
|
"required": ["config"],
|
|
"properties": {
|
|
"config": {
|
|
"required": ["brokers", "topic"],
|
|
"properties": {
|
|
"brokers": { "minItems": 1 }
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"pubsub": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"version": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"project_id": {
|
|
"type": "string",
|
|
"description": "GCP project ID (required when enabled)"
|
|
},
|
|
"topic_id": {
|
|
"type": "string",
|
|
"description": "Pub/Sub topic ID — just the ID, not the full resource name (required when enabled)"
|
|
},
|
|
"service_account_key": {
|
|
"anyOf": [
|
|
{ "type": "string" },
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"value": { "type": "string" },
|
|
"env_var": { "type": "string" },
|
|
"from_env": { "type": "boolean" }
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
],
|
|
"description": "Service account key JSON for authentication. Omit to use Application Default Credentials (ADC). Supports env.VAR_NAME prefix"
|
|
},
|
|
"auto_create_topic": {
|
|
"type": "boolean",
|
|
"description": "Create the topic at startup if it does not exist"
|
|
},
|
|
"disable_content_logging": {
|
|
"type": "boolean",
|
|
"description": "Strip request/response content from traces before publishing"
|
|
},
|
|
"request_headers": {
|
|
"type": "array",
|
|
"items": { "type": "string" },
|
|
"description": "Request-header name patterns (exact or wildcard like \"x-custom-*\") whose captured values are included in published traces"
|
|
},
|
|
"plugin_span_filter": {
|
|
"$ref": "#/$defs/pluginSpanFilter"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": { "const": true }
|
|
},
|
|
"required": ["enabled"]
|
|
},
|
|
"then": {
|
|
"required": ["config"],
|
|
"properties": {
|
|
"config": {
|
|
"required": ["project_id", "topic_id"]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"custom": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"version": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"config": {
|
|
"type": "object"
|
|
},
|
|
"placement": {
|
|
"type": "string",
|
|
"enum": ["pre_builtin", "post_builtin", "builtin"],
|
|
"default": "post_builtin",
|
|
"description": "Plugin execution placement relative to built-in plugins"
|
|
},
|
|
"order": {
|
|
"type": "integer",
|
|
"default": 0,
|
|
"description": "Position within placement group. Lower = earlier execution"
|
|
}
|
|
},
|
|
"required": ["name", "enabled"]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"governance": {
|
|
"type": "object",
|
|
"properties": {
|
|
"budgets": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"max_limit": {
|
|
"type": "number"
|
|
},
|
|
"reset_duration": {
|
|
"type": "string"
|
|
},
|
|
"virtual_key_id": {
|
|
"type": "string",
|
|
"description": "Associate this budget to a virtual key (mutually exclusive with provider_config_id and team_id)"
|
|
},
|
|
"provider_config_id": {
|
|
"type": "integer",
|
|
"description": "Associate this budget to a virtual key provider config (mutually exclusive with virtual_key_id and team_id)"
|
|
},
|
|
"model_config_id": {
|
|
"type": "string",
|
|
"description": "Associate this budget to a model config (mutually exclusive with the other owner IDs)"
|
|
},
|
|
"customer_id": {
|
|
"type": "string",
|
|
"description": "Associate this budget to a customer (mutually exclusive with the other owner IDs)"
|
|
},
|
|
"team_id": {
|
|
"type": "string",
|
|
"description": "Associate this budget to a team (mutually exclusive with virtual_key_id and provider_config_id)"
|
|
},
|
|
"calendar_aligned": {
|
|
"type": "boolean",
|
|
"description": "Snap budget reset windows to calendar boundaries",
|
|
"default": false
|
|
},
|
|
"current_usage": {
|
|
"type": "number"
|
|
},
|
|
"last_reset": {
|
|
"type": "string",
|
|
"format": "date-time"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"not": {
|
|
"required": ["virtual_key_id", "provider_config_id"]
|
|
}
|
|
},
|
|
{
|
|
"not": {
|
|
"required": ["virtual_key_id", "team_id"]
|
|
}
|
|
},
|
|
{
|
|
"not": {
|
|
"required": ["provider_config_id", "team_id"]
|
|
}
|
|
}
|
|
],
|
|
"required": ["id", "max_limit", "reset_duration"]
|
|
}
|
|
},
|
|
"rateLimits": {
|
|
"type": "array",
|
|
"description": "Rate limit configurations",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string",
|
|
"description": "Rate limit ID"
|
|
},
|
|
"token_max_limit": {
|
|
"type": "integer",
|
|
"description": "Maximum tokens allowed"
|
|
},
|
|
"token_reset_duration": {
|
|
"type": "string",
|
|
"description": "Token reset duration (e.g., '30s', '5m', '1h', '1d', '1w', '1M', '1Y')"
|
|
},
|
|
"token_current_usage": {
|
|
"type": "integer",
|
|
"description": "Current token usage",
|
|
"default": 0
|
|
},
|
|
"token_last_reset": {
|
|
"type": "string",
|
|
"format": "date-time",
|
|
"description": "Last time token counter was reset"
|
|
},
|
|
"request_max_limit": {
|
|
"type": "integer",
|
|
"description": "Maximum requests allowed"
|
|
},
|
|
"request_reset_duration": {
|
|
"type": "string",
|
|
"description": "Request reset duration (e.g., '30s', '5m', '1h', '1d', '1w', '1M', '1Y')"
|
|
},
|
|
"request_current_usage": {
|
|
"type": "integer",
|
|
"description": "Current request usage",
|
|
"default": 0
|
|
},
|
|
"request_last_reset": {
|
|
"type": "string",
|
|
"format": "date-time",
|
|
"description": "Last time request counter was reset"
|
|
}
|
|
},
|
|
"required": ["id"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"customers": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"budget_id": {
|
|
"type": "string"
|
|
},
|
|
"rate_limit_id": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["id", "name"]
|
|
}
|
|
},
|
|
"teams": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"customer_id": {
|
|
"type": "string"
|
|
},
|
|
"budget_id": {
|
|
"type": "string"
|
|
},
|
|
"rate_limit_id": {
|
|
"type": "string"
|
|
},
|
|
"business_unit_id": {
|
|
"type": "string"
|
|
},
|
|
"profile": {
|
|
"type": "object"
|
|
},
|
|
"config": {
|
|
"type": "object"
|
|
},
|
|
"claims": {
|
|
"type": "object"
|
|
}
|
|
},
|
|
"required": ["id", "name"]
|
|
}
|
|
},
|
|
"businessUnits": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"budget_id": {
|
|
"type": "string"
|
|
},
|
|
"rate_limit_id": {
|
|
"type": "string"
|
|
},
|
|
"profile": {
|
|
"type": "object"
|
|
},
|
|
"config": {
|
|
"type": "object"
|
|
},
|
|
"claims": {
|
|
"type": "object"
|
|
},
|
|
"teamIds": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"required": ["id", "name"]
|
|
}
|
|
},
|
|
"roles": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"type": "string"
|
|
},
|
|
"dac": {
|
|
"type": "string",
|
|
"enum": ["own-data", "team-data", "all-data"],
|
|
"default": "all-data"
|
|
},
|
|
"access_profile": {
|
|
"type": "string"
|
|
},
|
|
"permissions": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"resource": { "type": "string" },
|
|
"operation": { "type": "string" }
|
|
},
|
|
"required": ["resource", "operation"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"required": ["name"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"virtualKeys": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"type": "string"
|
|
},
|
|
"is_active": {
|
|
"type": "boolean"
|
|
},
|
|
"expires_at": {
|
|
"type": "string",
|
|
"format": "date-time",
|
|
"description": "Optional expiry timestamp (RFC3339). Once passed, requests using this virtual key are rejected. Omit for a key that never expires."
|
|
},
|
|
"team_id": {
|
|
"type": "string"
|
|
},
|
|
"customer_id": {
|
|
"type": "string"
|
|
},
|
|
"access_profile_id": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"rate_limit_id": {
|
|
"type": "string"
|
|
},
|
|
"calendar_aligned": {
|
|
"type": "boolean"
|
|
},
|
|
"provider_configs": {
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/$defs/virtualKeyProviderConfig"
|
|
}
|
|
},
|
|
"mcp_configs": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"mcp_client_id": {
|
|
"type": "integer"
|
|
},
|
|
"mcp_client_name": {
|
|
"type": "string"
|
|
},
|
|
"tools_to_execute": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"required": ["id", "name"]
|
|
}
|
|
},
|
|
"routingRules": {
|
|
"type": "array",
|
|
"description": "Routing rules for dynamic provider/model selection based on CEL expressions",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"type": "string"
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"default": true
|
|
},
|
|
"cel_expression": {
|
|
"type": "string"
|
|
},
|
|
"targets": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"description": "Weighted routing targets. Weights must sum to 1.",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"provider": {
|
|
"type": "string",
|
|
"description": "Target provider name"
|
|
},
|
|
"model": {
|
|
"type": "string",
|
|
"description": "Target model name"
|
|
},
|
|
"provider_key_name": {
|
|
"type": "string",
|
|
"description": "Optional provider key name. Resolved to internal key_id at config load time."
|
|
},
|
|
"weight": {
|
|
"type": "number",
|
|
"description": "Probability weight for this target (must be > 0, all weights must sum to 1)",
|
|
"exclusiveMinimum": 0,
|
|
"maximum": 1
|
|
}
|
|
},
|
|
"required": ["weight"]
|
|
}
|
|
},
|
|
"fallbacks": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"scope": {
|
|
"type": "string",
|
|
"enum": ["global", "team", "customer", "virtual_key"],
|
|
"default": "global"
|
|
},
|
|
"scope_id": {
|
|
"type": ["string", "null"]
|
|
},
|
|
"priority": {
|
|
"type": "integer",
|
|
"default": 0
|
|
},
|
|
"query": {
|
|
"description": "Visual rule builder state for the management UI (react-querybuilder). Omitted unless exported from the dashboard. Not evaluated at routing runtime (cel_expression is). When present, must include combinator and rules[].",
|
|
"anyOf": [
|
|
{
|
|
"type": "null"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"required": ["combinator", "rules"],
|
|
"properties": {
|
|
"combinator": {
|
|
"type": "string",
|
|
"enum": ["and", "or"]
|
|
},
|
|
"rules": {
|
|
"type": "array",
|
|
"description": "Leaf rules (field, operator, value) and/or nested combinator+rules groups from the query builder."
|
|
}
|
|
},
|
|
"additionalProperties": true
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"required": ["id", "name", "targets"]
|
|
}
|
|
},
|
|
"authConfig": {
|
|
"$ref": "#/$defs/authConfig"
|
|
},
|
|
"modelConfigs": {
|
|
"type": "array",
|
|
"description": "Per-model rate limit and budget configurations",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"model_name": {
|
|
"type": "string",
|
|
"description": "Model name, or \"*\" to match all models"
|
|
},
|
|
"provider": {
|
|
"type": "string",
|
|
"description": "Provider name; omit to apply to all providers"
|
|
},
|
|
"scope": {
|
|
"type": "string",
|
|
"enum": ["global", "virtual_key"],
|
|
"default": "global",
|
|
"description": "Scope where this limit applies"
|
|
},
|
|
"scope_id": {
|
|
"type": "string",
|
|
"description": "Target entity ID — required when scope is \"virtual_key\""
|
|
},
|
|
"calendar_aligned": {
|
|
"type": "boolean",
|
|
"description": "Snap this config's budget reset windows to calendar boundaries rather than rolling windows; virtual_key-scoped configs inherit the virtual key's setting",
|
|
"default": false
|
|
},
|
|
"budget_id": {
|
|
"type": "string"
|
|
},
|
|
"rate_limit_id": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["id", "model_name"]
|
|
}
|
|
},
|
|
"providers": {
|
|
"type": "array",
|
|
"description": "Provider-level governance configurations",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string",
|
|
"description": "Provider name"
|
|
},
|
|
"budget_id": {
|
|
"type": "string"
|
|
},
|
|
"rate_limit_id": {
|
|
"type": "string"
|
|
},
|
|
"send_back_raw_request": {
|
|
"type": "boolean"
|
|
},
|
|
"send_back_raw_response": {
|
|
"type": "boolean"
|
|
},
|
|
"store_raw_request_response": {
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"required": ["name"]
|
|
}
|
|
},
|
|
"pricingOverrides": {
|
|
"type": "array",
|
|
"description": "Scoped pricing overrides applied at runtime by the model catalog",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string",
|
|
"description": "Unique pricing override ID"
|
|
},
|
|
"name": {
|
|
"type": "string",
|
|
"description": "Human-readable name for this override"
|
|
},
|
|
"scope_kind": {
|
|
"type": "string",
|
|
"enum": [
|
|
"global",
|
|
"provider",
|
|
"provider_key",
|
|
"virtual_key",
|
|
"virtual_key_provider",
|
|
"virtual_key_provider_key"
|
|
],
|
|
"description": "Scope level for this override"
|
|
},
|
|
"virtual_key_id": {
|
|
"type": "string",
|
|
"description": "Virtual key ID (required for virtual_key* scopes)"
|
|
},
|
|
"provider_id": {
|
|
"type": "string",
|
|
"description": "Provider name (required for provider* scopes; field key remains provider_id for compatibility)"
|
|
},
|
|
"provider_key_name": {
|
|
"type": "string",
|
|
"description": "Provider key name alias. Resolved to internal provider key ID at config load time."
|
|
},
|
|
"match_type": {
|
|
"type": "string",
|
|
"enum": ["exact", "wildcard"],
|
|
"description": "How the pattern is matched against model names"
|
|
},
|
|
"pattern": {
|
|
"type": "string",
|
|
"description": "Model name pattern to match"
|
|
},
|
|
"request_types": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Request types this override applies to"
|
|
},
|
|
"pricing_patch": {
|
|
"type": "string",
|
|
"description": "JSON-encoded pricing fields to override"
|
|
},
|
|
"config_hash": {
|
|
"type": "string",
|
|
"description": "Internal hash for change detection (auto-managed)"
|
|
}
|
|
},
|
|
"required": ["id", "name", "scope_kind", "match_type", "pattern", "request_types"]
|
|
}
|
|
},
|
|
"complexityAnalyzerConfig": {
|
|
"type": ["object", "null"],
|
|
"description": "Runtime configuration for complexity_tier CEL routing. Renders into governance.complexity_analyzer_config in config.json.",
|
|
"properties": {
|
|
"tier_boundaries": {
|
|
"type": "object",
|
|
"properties": {
|
|
"simple_medium": {
|
|
"type": "number",
|
|
"exclusiveMinimum": 0,
|
|
"exclusiveMaximum": 1
|
|
},
|
|
"medium_complex": {
|
|
"type": "number",
|
|
"exclusiveMinimum": 0,
|
|
"exclusiveMaximum": 1
|
|
},
|
|
"complex_reasoning": {
|
|
"type": "number",
|
|
"exclusiveMinimum": 0,
|
|
"exclusiveMaximum": 1
|
|
}
|
|
},
|
|
"required": ["simple_medium", "medium_complex", "complex_reasoning"],
|
|
"additionalProperties": false
|
|
},
|
|
"keywords": {
|
|
"type": "object",
|
|
"properties": {
|
|
"code_keywords": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"minItems": 1
|
|
},
|
|
"reasoning_keywords": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"minItems": 1
|
|
},
|
|
"technical_keywords": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"minItems": 1
|
|
},
|
|
"simple_keywords": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"minItems": 1
|
|
}
|
|
},
|
|
"required": ["code_keywords", "reasoning_keywords", "technical_keywords", "simple_keywords"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"required": ["tier_boundaries", "keywords"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"cluster": {
|
|
"type": "object",
|
|
"description": "Cluster mode configuration",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether cluster mode is enabled"
|
|
},
|
|
"peers": {
|
|
"type": "array",
|
|
"description": "List of peer addresses",
|
|
"items": {
|
|
"type": "string",
|
|
"description": "Peer address in host:port format"
|
|
}
|
|
},
|
|
"region": {
|
|
"type": "string",
|
|
"description": "Region label for cluster deployment (runtime default: unknown)"
|
|
},
|
|
"gossip": {
|
|
"type": "object",
|
|
"description": "Gossip protocol configuration",
|
|
"properties": {
|
|
"port": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 65535,
|
|
"description": "Port for gossip communication"
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"description": "Gossip protocol settings",
|
|
"properties": {
|
|
"timeoutSeconds": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Timeout for operations in seconds"
|
|
},
|
|
"successThreshold": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Number of successful probes required"
|
|
},
|
|
"failureThreshold": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Number of failed probes before marking as failed"
|
|
}
|
|
},
|
|
"required": ["timeoutSeconds", "successThreshold", "failureThreshold"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"required": ["port", "config"],
|
|
"additionalProperties": false
|
|
},
|
|
"grpc": {
|
|
"type": "object",
|
|
"description": "gRPC transport settings for cluster counter-sync. Replaces gossip broadcast for governance counters; memberlist still handles membership.",
|
|
"properties": {
|
|
"port": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 65535,
|
|
"description": "TCP port for the cluster gRPC server"
|
|
},
|
|
"dialTimeoutSeconds": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Timeout when dialing peers, in seconds"
|
|
}
|
|
}
|
|
},
|
|
"discovery": {
|
|
"type": "object",
|
|
"description": "Auto-discovery configuration for cluster nodes",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether auto-discovery is enabled"
|
|
},
|
|
"type": {
|
|
"type": "string",
|
|
"enum": ["", "kubernetes", "dns", "udp", "consul", "etcd", "mdns"],
|
|
"description": "Discovery type (empty when not configured)"
|
|
},
|
|
"serviceName": {
|
|
"type": "string",
|
|
"description": "Service name for discovery backends (required for consul/etcd/udp; used as default for mdns)"
|
|
},
|
|
"bindPort": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 65535,
|
|
"description": "Port to bind for cluster communication"
|
|
},
|
|
"dialTimeout": {
|
|
"type": "string",
|
|
"description": "Timeout for discovery dial operations as a Go duration string (e.g. '5s', '1m')"
|
|
},
|
|
"allowedAddressSpace": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "CIDR notation for allowed address spaces (e.g., ['10.0.0.0/8', '192.168.0.0/16'])"
|
|
},
|
|
"k8sNamespace": {
|
|
"type": "string",
|
|
"description": "Kubernetes namespace for service discovery"
|
|
},
|
|
"k8sLabelSelector": {
|
|
"type": "string",
|
|
"description": "Kubernetes label selector for filtering pods"
|
|
},
|
|
"dnsNames": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "DNS names to resolve for node discovery. Supports env.VAR_NAME for environment variable substitution."
|
|
},
|
|
"udpBroadcastPort": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"maximum": 65535,
|
|
"description": "UDP broadcast port (0 means not configured)"
|
|
},
|
|
"consulAddress": {
|
|
"type": "string",
|
|
"description": "Consul server address for service discovery"
|
|
},
|
|
"etcdEndpoints": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Etcd endpoints for service discovery"
|
|
},
|
|
"mdnsService": {
|
|
"type": "string",
|
|
"description": "mDNS service name for local network discovery"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"type": { "const": "udp" }
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["udpBroadcastPort", "allowedAddressSpace"]
|
|
}
|
|
}
|
|
],
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["type"]
|
|
}
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["gossip"]
|
|
}
|
|
},
|
|
"scim": {
|
|
"type": "object",
|
|
"description": "SAML/SCIM (System for Cross-domain Identity Management) configuration",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether SAML/SCIM authentication is enabled"
|
|
},
|
|
"provider": {
|
|
"type": "string",
|
|
"enum": ["", "okta", "entra", "keycloak", "zitadel", "google", "sailpoint", "generic"],
|
|
"description": "SCIM/SSO provider type (empty when not configured)"
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"description": "Provider-specific configuration"
|
|
}
|
|
},
|
|
"required": ["enabled"],
|
|
"additionalProperties": false,
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": { "enabled": { "const": true } },
|
|
"required": ["enabled"]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"provider": {
|
|
"enum": ["okta", "entra", "keycloak", "zitadel", "google", "sailpoint", "generic"]
|
|
}
|
|
},
|
|
"required": ["provider"]
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
},
|
|
"provider": {
|
|
"const": "okta"
|
|
}
|
|
},
|
|
"required": ["enabled", "provider"]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"config": {
|
|
"type": "object",
|
|
"description": "Okta JWT authentication configuration",
|
|
"properties": {
|
|
"issuerUrl": {
|
|
"type": "string",
|
|
"format": "uri",
|
|
"description": "Okta issuer URL (e.g., https://your-domain.okta.com/oauth2/default)"
|
|
},
|
|
"authServerType": {
|
|
"type": "string",
|
|
"enum": ["org", "custom"],
|
|
"description": "'org' for Org Authorization Server or 'custom' for Custom Authorization Server. Auto-detected from issuer URL when omitted."
|
|
},
|
|
"clientId": {
|
|
"type": "string",
|
|
"description": "Okta application client ID"
|
|
},
|
|
"clientSecret": {
|
|
"type": "string",
|
|
"description": "Okta client secret"
|
|
},
|
|
"apiToken": {
|
|
"type": "string",
|
|
"description": "Okta API token for Admin API access"
|
|
},
|
|
"audience": {
|
|
"type": "string",
|
|
"description": "JWT audience for validation (optional)"
|
|
},
|
|
"userIdField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for user ID (default: 'sub')",
|
|
"default": "sub"
|
|
},
|
|
"teamIdsField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for team IDs (default: 'groups')",
|
|
"default": "groups"
|
|
},
|
|
"rolesField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for roles (default: 'roles')",
|
|
"default": "roles"
|
|
},
|
|
"attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"},
|
|
"attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"},
|
|
"attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"},
|
|
"claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"}
|
|
},
|
|
"required": ["issuerUrl", "clientId", "clientSecret", "apiToken"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
},
|
|
"provider": {
|
|
"const": "entra"
|
|
}
|
|
},
|
|
"required": ["enabled", "provider"]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"config": {
|
|
"type": "object",
|
|
"description": "Microsoft Entra ID (formerly Azure AD) JWT authentication configuration",
|
|
"properties": {
|
|
"tenantId": {
|
|
"type": "string",
|
|
"description": "Azure tenant ID or 'common' for multi-tenant applications"
|
|
},
|
|
"clientId": {
|
|
"type": "string",
|
|
"description": "Application (client) ID from Azure portal"
|
|
},
|
|
"clientSecret": {
|
|
"type": "string",
|
|
"description": "Client secret (optional, required for token revocation)"
|
|
},
|
|
"cloud": {
|
|
"type": "string",
|
|
"enum": ["commercial", "gcc-high", "dod"],
|
|
"default": "commercial",
|
|
"description": "Cloud environment: 'commercial' (default), 'gcc-high' for US Government GCC High, or 'dod' for Department of Defense"
|
|
},
|
|
"audience": {
|
|
"type": "string",
|
|
"description": "JWT audience for validation (default: clientId)"
|
|
},
|
|
"appIdUri": {
|
|
"type": "string",
|
|
"format": "uri",
|
|
"description": "App ID URI for v1.0 tokens (e.g., api://{clientId})"
|
|
},
|
|
"userIdField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for user ID (default: 'oid')",
|
|
"default": "oid"
|
|
},
|
|
"teamIdsField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for team IDs (default: 'groups')",
|
|
"default": "groups"
|
|
},
|
|
"rolesField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for roles (default: 'roles')",
|
|
"default": "roles"
|
|
},
|
|
"attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"},
|
|
"attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"},
|
|
"attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"},
|
|
"claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"}
|
|
},
|
|
"required": ["tenantId", "clientId"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
},
|
|
"provider": {
|
|
"const": "keycloak"
|
|
}
|
|
},
|
|
"required": ["enabled", "provider"]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"config": {
|
|
"type": "object",
|
|
"description": "Keycloak OIDC/SCIM authentication configuration",
|
|
"properties": {
|
|
"serverUrl": {
|
|
"type": "string",
|
|
"format": "uri",
|
|
"description": "Base URL of the Keycloak server (e.g., https://keycloak.company.com). Must NOT include the /realms/{realm} suffix."
|
|
},
|
|
"realm": {
|
|
"type": "string",
|
|
"description": "Keycloak realm name (e.g., 'bifrost-prod')"
|
|
},
|
|
"clientId": {
|
|
"type": "string",
|
|
"description": "Keycloak client ID for the confidential client used by Bifrost"
|
|
},
|
|
"clientSecret": {
|
|
"type": "string",
|
|
"description": "Keycloak client secret. Supports env. prefix for environment variable references (e.g., 'env.KEYCLOAK_CLIENT_SECRET')"
|
|
},
|
|
"audience": {
|
|
"type": "string",
|
|
"description": "Expected JWT audience (default: clientId)"
|
|
},
|
|
"userIdField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for user ID (default: 'sub')",
|
|
"default": "sub"
|
|
},
|
|
"teamIdsField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for team IDs (default: 'groups')",
|
|
"default": "groups"
|
|
},
|
|
"rolesField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for roles (default: 'roles')",
|
|
"default": "roles"
|
|
},
|
|
"attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"},
|
|
"attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"},
|
|
"attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"},
|
|
"claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"}
|
|
},
|
|
"required": ["serverUrl", "realm", "clientId", "clientSecret"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
},
|
|
"provider": {
|
|
"const": "zitadel"
|
|
}
|
|
},
|
|
"required": ["enabled", "provider"]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"config": {
|
|
"type": "object",
|
|
"description": "Zitadel OIDC authentication configuration",
|
|
"properties": {
|
|
"domain": {
|
|
"type": "string",
|
|
"format": "hostname",
|
|
"pattern": "^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$",
|
|
"description": "Zitadel instance domain (e.g., 'my-instance.zitadel.cloud' or 'auth.company.com'). Bare host only - do NOT include the scheme, port, or path."
|
|
},
|
|
"clientId": {
|
|
"type": "string",
|
|
"description": "Zitadel application client ID"
|
|
},
|
|
"clientSecret": {
|
|
"type": "string",
|
|
"description": "Zitadel client secret (optional, required for confidential clients and token revocation)"
|
|
},
|
|
"projectId": {
|
|
"type": "string",
|
|
"description": "Optional Zitadel project ID for project-scoped role claims"
|
|
},
|
|
"audience": {
|
|
"type": "string",
|
|
"description": "Access-token audience override (default: clientId)"
|
|
},
|
|
"serviceAccountClientId": {
|
|
"type": "string",
|
|
"description": "Service account client ID for Zitadel Management API (required for user provisioning - web apps cannot use client_credentials)"
|
|
},
|
|
"serviceAccountClientSecret": {
|
|
"type": "string",
|
|
"description": "Service account client secret for Zitadel Management API"
|
|
},
|
|
"teamIdsField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for team/group IDs (default: 'groups')",
|
|
"default": "groups"
|
|
},
|
|
"attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"},
|
|
"attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"},
|
|
"attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"},
|
|
"claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"}
|
|
},
|
|
"required": ["domain", "clientId"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
},
|
|
"provider": {
|
|
"const": "google"
|
|
}
|
|
},
|
|
"required": ["enabled", "provider"]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"config": {
|
|
"type": "object",
|
|
"description": "Google Workspace OIDC authentication configuration",
|
|
"properties": {
|
|
"domain": {
|
|
"type": "string",
|
|
"format": "hostname",
|
|
"pattern": "^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$",
|
|
"description": "Google Workspace primary domain (e.g., 'company.com'). Bare host only - do NOT include the scheme, port, or path."
|
|
},
|
|
"clientId": {
|
|
"type": "string",
|
|
"description": "Google OAuth2 client ID"
|
|
},
|
|
"clientSecret": {
|
|
"type": "string",
|
|
"description": "Google client secret (optional, used for token revocation)"
|
|
},
|
|
"credentialMode": {
|
|
"type": "string",
|
|
"enum": ["", "inherit", "env", "file"],
|
|
"description": "How Directory API credentials are sourced. 'inherit' uses Application Default Credentials; 'env' uses serviceAccountEnvVar; 'file' uses serviceAccountFile."
|
|
},
|
|
"serviceAccountEnvVar": {
|
|
"type": "string",
|
|
"description": "Name of the environment variable containing the service account JSON (used when credentialMode is 'env'). Required for Directory API access without ADC."
|
|
},
|
|
"serviceAccountFile": {
|
|
"type": "string",
|
|
"description": "Filesystem path to the service account JSON key file (used when credentialMode is 'file')."
|
|
},
|
|
"adminEmail": {
|
|
"type": "string",
|
|
"format": "email",
|
|
"description": "Admin email for domain-wide delegation. Required whenever Directory API access is configured."
|
|
},
|
|
"impersonateServiceAccount": {
|
|
"type": "string",
|
|
"description": "GCP service account email to impersonate when using ADC (Workload Identity); must have domain-wide delegation configured."
|
|
},
|
|
"audience": {
|
|
"type": "string",
|
|
"description": "JWT audience override (default: clientId)"
|
|
},
|
|
"teamIdsField": {
|
|
"type": "string",
|
|
"description": "Claim field for team/group IDs (default: 'groups')",
|
|
"default": "groups"
|
|
},
|
|
"attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"},
|
|
"attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"},
|
|
"attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"},
|
|
"claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"}
|
|
},
|
|
"required": ["domain", "clientId"],
|
|
"additionalProperties": false,
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"credentialMode": { "const": "env" }
|
|
},
|
|
"required": ["credentialMode"]
|
|
},
|
|
"then": {
|
|
"required": ["serviceAccountEnvVar"]
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"credentialMode": { "const": "file" }
|
|
},
|
|
"required": ["credentialMode"]
|
|
},
|
|
"then": {
|
|
"required": ["serviceAccountFile"]
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"credentialMode": {
|
|
"enum": ["inherit", "env", "file"]
|
|
}
|
|
},
|
|
"required": ["credentialMode"]
|
|
},
|
|
"then": {
|
|
"required": ["adminEmail"]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": { "const": true },
|
|
"provider": { "const": "sailpoint" }
|
|
},
|
|
"required": ["enabled", "provider"]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"config": {
|
|
"type": "object",
|
|
"description": "SailPoint identity security platform configuration",
|
|
"properties": {
|
|
"product": {
|
|
"type": "string",
|
|
"enum": ["isc", "iiq"],
|
|
"description": "SailPoint product type: 'isc' for Identity Security Cloud, 'iiq' for IdentityIQ"
|
|
},
|
|
"tenant": {
|
|
"type": "string",
|
|
"description": "ISC tenant identifier (required for ISC product)"
|
|
},
|
|
"baseUrl": {
|
|
"type": "string",
|
|
"format": "uri",
|
|
"description": "IdentityIQ base URL (required for IIQ product)"
|
|
},
|
|
"username": {
|
|
"type": "string",
|
|
"description": "Username for IdentityIQ authentication"
|
|
},
|
|
"password": {
|
|
"type": "string",
|
|
"description": "Password for IdentityIQ authentication"
|
|
},
|
|
"clientId": {
|
|
"type": "string",
|
|
"description": "OAuth2 client ID"
|
|
},
|
|
"clientSecret": {
|
|
"type": "string",
|
|
"description": "OAuth2 client secret"
|
|
},
|
|
"teamIdsField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for team IDs"
|
|
},
|
|
"attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"},
|
|
"attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"},
|
|
"attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"},
|
|
"claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"}
|
|
},
|
|
"required": ["product"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": { "const": true },
|
|
"provider": { "const": "generic" }
|
|
},
|
|
"required": ["enabled", "provider"]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"config": {
|
|
"type": "object",
|
|
"description": "Generic OIDC authentication configuration",
|
|
"properties": {
|
|
"issuerUrl": {
|
|
"type": "string",
|
|
"format": "uri",
|
|
"description": "OIDC issuer URL"
|
|
},
|
|
"clientId": {
|
|
"type": "string",
|
|
"description": "OAuth2 client ID"
|
|
},
|
|
"clientSecret": {
|
|
"type": "string",
|
|
"description": "OAuth2 client secret"
|
|
},
|
|
"audience": {
|
|
"type": "string",
|
|
"description": "JWT audience for validation"
|
|
},
|
|
"authorizationEndpoint": {
|
|
"type": "string",
|
|
"format": "uri",
|
|
"description": "Override for the authorization endpoint"
|
|
},
|
|
"tokenEndpoint": {
|
|
"type": "string",
|
|
"format": "uri",
|
|
"description": "Override for the token endpoint"
|
|
},
|
|
"userinfoEndpoint": {
|
|
"type": "string",
|
|
"format": "uri",
|
|
"description": "Override for the userinfo endpoint"
|
|
},
|
|
"teamIdsField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for team IDs"
|
|
},
|
|
"rolesField": {
|
|
"type": "string",
|
|
"description": "JWT claim field for roles"
|
|
},
|
|
"scopes": {
|
|
"type": "array",
|
|
"description": "Additional OAuth2 scopes to request",
|
|
"items": { "type": "string" }
|
|
},
|
|
"attributeRoleMappings": {"$ref": "#/$defs/scim_attribute_role_mappings"},
|
|
"attributeTeamMappings": {"$ref": "#/$defs/scim_attribute_team_mappings"},
|
|
"attributeBusinessUnitMappings": {"$ref": "#/$defs/scim_attribute_business_unit_mappings"},
|
|
"claimScimAttributes": {"$ref": "#/$defs/scim_claim_attributes"}
|
|
},
|
|
"required": ["issuerUrl", "clientId"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"loadBalancer": {
|
|
"type": "object",
|
|
"description": "Load balancer configuration for intelligent request routing",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether load balancing is enabled"
|
|
},
|
|
"directionSelectionEnabled": {
|
|
"type": "boolean",
|
|
"description": "Enable adaptive provider (direction) selection. Defaults to true; omit to leave on."
|
|
},
|
|
"routeSelectionEnabled": {
|
|
"type": "boolean",
|
|
"description": "Enable adaptive per-key (route) selection. Defaults to true; omit to leave on."
|
|
},
|
|
"rerouteFailedDirections": {
|
|
"type": "boolean",
|
|
"description": "When a pinned provider's direction is unhealthy, re-route the request to a healthy provider. Defaults to false."
|
|
},
|
|
"pruneFailedFallbacks": {
|
|
"type": "boolean",
|
|
"description": "Drop unhealthy directions from a request's configured fallbacks. Defaults to false."
|
|
},
|
|
"trackerConfig": {
|
|
"type": "object",
|
|
"description": "Configuration for tracking route metrics and performance"
|
|
},
|
|
"bootstrap": {
|
|
"type": "object"
|
|
}
|
|
}
|
|
},
|
|
"guardrails": {
|
|
"type": "object",
|
|
"description": "Guardrails configuration for content moderation and policy enforcement",
|
|
"properties": {
|
|
"rules": {
|
|
"type": "array",
|
|
"description": "List of guardrail rules",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "integer",
|
|
"description": "Unique identifier for the rule"
|
|
},
|
|
"name": {
|
|
"type": "string",
|
|
"description": "Name of the guardrail rule"
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"description": "Description of what the rule does"
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether this rule is enabled"
|
|
},
|
|
"cel_expression": {
|
|
"type": "string",
|
|
"description": "CEL (Common Expression Language) expression for rule evaluation"
|
|
},
|
|
"query": {
|
|
"description": "Visual rule builder state for the management UI (react-querybuilder). Omitted unless exported from the dashboard. Not evaluated at runtime (cel_expression is).",
|
|
"anyOf": [
|
|
{
|
|
"type": "null"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"required": ["combinator", "rules"],
|
|
"properties": {
|
|
"combinator": {
|
|
"type": "string",
|
|
"enum": ["and", "or"]
|
|
},
|
|
"rules": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object"
|
|
},
|
|
"description": "Leaf rules and/or nested combinator+rules groups from the query builder."
|
|
}
|
|
},
|
|
"additionalProperties": true
|
|
}
|
|
]
|
|
},
|
|
"apply_to": {
|
|
"type": "string",
|
|
"enum": ["input", "output", "both"],
|
|
"description": "When to apply the guardrail (input, output, or both)"
|
|
},
|
|
"sampling_rate": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"maximum": 100,
|
|
"description": "Percentage of requests to apply this rule to (0-100)"
|
|
},
|
|
"timeout": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"description": "Timeout in seconds for rule execution"
|
|
},
|
|
"max_turns_to_send": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"description": "Number of historical conversation turns to send to the guardrail provider; the latest message is always included on top. 0 sends all turns."
|
|
},
|
|
"evaluation_mode": {
|
|
"type": "string",
|
|
"enum": ["bundled", "per_turn"],
|
|
"default": "bundled",
|
|
"description": "How the rule's turns are sent to its guardrail providers. 'bundled' (default) concatenates all turns into one guardrail call. 'per_turn' sends each turn in its own call, evaluated in isolation, to avoid context-sensitive classifiers (e.g. Bedrock prompt-attack) combining unrelated turns into a false-positive block; this scans every turn but uses more provider calls."
|
|
},
|
|
"provider_config_ids": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "integer"
|
|
},
|
|
"description": "IDs of provider configurations to use with this rule"
|
|
}
|
|
},
|
|
"required": ["id", "name", "enabled", "cel_expression", "apply_to"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"providers": {
|
|
"type": "array",
|
|
"description": "List of guardrail provider configurations",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "integer",
|
|
"description": "Unique identifier for the provider config"
|
|
},
|
|
"provider_name": {
|
|
"type": "string",
|
|
"description": "Name of the guardrail provider (e.g., 'bedrock', 'azure')"
|
|
},
|
|
"policy_name": {
|
|
"type": "string",
|
|
"description": "Name of the specific policy to use"
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether this provider config is enabled"
|
|
},
|
|
"timeout": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"description": "Timeout in seconds for provider execution"
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"description": "Provider-specific configuration"
|
|
}
|
|
},
|
|
"required": ["id", "provider_name", "policy_name", "enabled"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"skillsRegistry": {
|
|
"type": "object",
|
|
"description": "Declarative Skills Repository definitions reconciled from config.json. Rendered verbatim into skills_registry.",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether config-defined skills should be reconciled at startup"
|
|
},
|
|
"skills": {
|
|
"type": "array",
|
|
"description": "Skills to create or update from config.json",
|
|
"items": {
|
|
"type": "object",
|
|
"required": ["name", "description", "skill_md_body", "version"],
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"type": "string"
|
|
},
|
|
"license": {
|
|
"type": "string"
|
|
},
|
|
"compatibility": {
|
|
"type": "string"
|
|
},
|
|
"allowed_tools": {
|
|
"type": "string"
|
|
},
|
|
"extra_frontmatter": {
|
|
"type": "object",
|
|
"additionalProperties": true
|
|
},
|
|
"metadata": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"skill_md_body": {
|
|
"type": "string"
|
|
},
|
|
"version": {
|
|
"type": "string"
|
|
},
|
|
"files": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"required": ["path", "source_type"],
|
|
"properties": {
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"source_type": {
|
|
"type": "string",
|
|
"enum": ["text", "url", "dataurl"]
|
|
},
|
|
"url": {
|
|
"type": "string"
|
|
},
|
|
"content": {
|
|
"type": "string"
|
|
},
|
|
"dataurl": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"source_type": {
|
|
"const": "url"
|
|
}
|
|
},
|
|
"required": ["url"]
|
|
},
|
|
{
|
|
"properties": {
|
|
"source_type": {
|
|
"const": "text"
|
|
}
|
|
},
|
|
"required": ["content"]
|
|
},
|
|
{
|
|
"properties": {
|
|
"source_type": {
|
|
"const": "dataurl"
|
|
}
|
|
},
|
|
"required": ["dataurl"]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"accessProfiles": {
|
|
"type": "array",
|
|
"description": "Enterprise access profile templates rendered as top-level access_profiles in config.json",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"type": "string"
|
|
},
|
|
"is_active": {
|
|
"type": "boolean"
|
|
},
|
|
"tags": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"budgets": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"max_limit": {
|
|
"type": "number"
|
|
},
|
|
"reset_duration": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["id", "max_limit", "reset_duration"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"rate_limit": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"token_max_limit": {
|
|
"type": "integer"
|
|
},
|
|
"token_reset_duration": {
|
|
"type": "string"
|
|
},
|
|
"request_max_limit": {
|
|
"type": "integer"
|
|
},
|
|
"request_reset_duration": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["id"],
|
|
"additionalProperties": false
|
|
},
|
|
"provider_configs": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"provider_name": {
|
|
"type": "string"
|
|
},
|
|
"all_models_allowed": {
|
|
"type": "boolean"
|
|
},
|
|
"allowed_models": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"budgets": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"max_limit": {
|
|
"type": "number"
|
|
},
|
|
"reset_duration": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["id", "max_limit", "reset_duration"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"rate_limit": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"token_max_limit": {
|
|
"type": "integer"
|
|
},
|
|
"token_reset_duration": {
|
|
"type": "string"
|
|
},
|
|
"request_max_limit": {
|
|
"type": "integer"
|
|
},
|
|
"request_reset_duration": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"key_ids": {
|
|
"type": "array",
|
|
"description": "Key IDs allowed for this provider config. Use [\"*\"] to allow all keys; empty array or omitted denies all keys. Specific IDs restrict access to those keys only.",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"required": ["provider_name"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"mcp_tool_groups": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"tool_group_id": {
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"required": ["tool_group_id"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"mcp_servers": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"mcp_server_id": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["mcp_server_id"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"mcp_tool_overrides": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"mcp_client_id": {
|
|
"type": "string"
|
|
},
|
|
"tool_name": {
|
|
"type": "string"
|
|
},
|
|
"action": {
|
|
"type": "string",
|
|
"enum": ["include", "exclude"]
|
|
}
|
|
},
|
|
"required": ["mcp_client_id", "tool_name", "action"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"required": ["name"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"auditLogs": {
|
|
"type": "object",
|
|
"properties": {
|
|
"disabled": {
|
|
"type": "boolean"
|
|
},
|
|
"hmacKey": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"largePayloadOptimization": {
|
|
"type": "object",
|
|
"description": "Large payload streaming optimization configuration",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"requestThresholdBytes": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"default": 10485760
|
|
},
|
|
"responseThresholdBytes": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"default": 10485760
|
|
},
|
|
"prefetchSizeBytes": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"default": 65536
|
|
},
|
|
"maxPayloadBytes": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"default": 524288000
|
|
},
|
|
"truncatedLogBytes": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"default": 1048576
|
|
}
|
|
}
|
|
},
|
|
"websocket": {
|
|
"type": "object",
|
|
"description": "Optional tuning for the WebSocket gateway (Responses API WebSocket Mode, Realtime API). WebSocket is always enabled; these fields override the high defaults.",
|
|
"properties": {
|
|
"maxConnectionsPerUser": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Maximum concurrent WebSocket connections per user",
|
|
"default": 100
|
|
},
|
|
"transcriptBufferSize": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Number of transcript entries to buffer for Realtime API mid-session fallback",
|
|
"default": 100
|
|
},
|
|
"pool": {
|
|
"type": "object",
|
|
"description": "Upstream WebSocket connection pool configuration",
|
|
"properties": {
|
|
"maxIdlePerKey": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Maximum idle connections per provider/key combination",
|
|
"default": 50
|
|
},
|
|
"maxTotalConnections": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Maximum total idle connections across all providers",
|
|
"default": 1000
|
|
},
|
|
"idleTimeoutSeconds": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Seconds before an idle connection is evicted",
|
|
"default": 600
|
|
},
|
|
"maxConnectionLifetimeSeconds": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Maximum lifetime of a connection in seconds",
|
|
"default": 7200
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"circuitBreakerConfig": {
|
|
"type": "object",
|
|
"description": "Circuit breaker configuration for automatic failover when a provider endpoint degrades",
|
|
"properties": {
|
|
"policies": {
|
|
"type": "array",
|
|
"description": "List of circuit breaker policies",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string",
|
|
"description": "Unique name for this policy"
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether this policy is active"
|
|
},
|
|
"primary_provider": {
|
|
"type": "string",
|
|
"description": "Provider to monitor (e.g. 'azure', 'openai')"
|
|
},
|
|
"primary_model": {
|
|
"type": "string",
|
|
"description": "Model to monitor as it appears in requests"
|
|
},
|
|
"primary_key_ids": {
|
|
"type": "array",
|
|
"description": "Optional key UUIDs to monitor individually; empty uses a single shared circuit",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"fallback_provider": {
|
|
"type": "string",
|
|
"description": "Provider to route to when the circuit is open"
|
|
},
|
|
"fallback_model": {
|
|
"type": "string",
|
|
"description": "Model to request from the fallback provider"
|
|
},
|
|
"condition": {
|
|
"type": "object",
|
|
"description": "Response signals that trigger the circuit to open",
|
|
"properties": {
|
|
"operator": {
|
|
"type": "string",
|
|
"enum": ["OR", "AND"],
|
|
"default": "OR"
|
|
},
|
|
"signals": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"source": {
|
|
"type": "string",
|
|
"enum": ["response_header"]
|
|
},
|
|
"header_name": {
|
|
"type": "string"
|
|
},
|
|
"header_value": {
|
|
"type": "string"
|
|
},
|
|
"header_contains": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["source", "header_name"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"required": ["signals"],
|
|
"additionalProperties": false
|
|
},
|
|
"default_cooldown": {
|
|
"type": "string",
|
|
"pattern": "^[0-9]+(ns|us|µs|ms|s|m|h)$",
|
|
"description": "How long to keep the circuit open when no header-based cooldown is available (Go duration, e.g. '30s')"
|
|
},
|
|
"cooldown_header": {
|
|
"type": "string",
|
|
"description": "Response header whose value (in ms) overrides default_cooldown"
|
|
}
|
|
},
|
|
"required": ["name", "primary_provider", "primary_model", "fallback_provider", "fallback_model", "condition"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"storage": {
|
|
"type": "object",
|
|
"properties": {
|
|
"mode": {
|
|
"type": "string",
|
|
"enum": ["sqlite", "postgres"]
|
|
},
|
|
"persistence": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"storageClass": {
|
|
"type": "string"
|
|
},
|
|
"accessMode": {
|
|
"type": "string",
|
|
"enum": ["ReadWriteOnce", "ReadWriteMany", "ReadOnlyMany"]
|
|
},
|
|
"size": {
|
|
"type": "string"
|
|
},
|
|
"existingClaim": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"configStore": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"type": {
|
|
"type": "string",
|
|
"enum": ["", "sqlite", "postgres"]
|
|
},
|
|
"maxIdleConns": {
|
|
"type": "integer",
|
|
"minimum": 0
|
|
},
|
|
"maxOpenConns": {
|
|
"type": "integer",
|
|
"minimum": 2
|
|
},
|
|
"vaultStore": {
|
|
"type": "object",
|
|
"description": "Vault store for external secret management",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"type": {
|
|
"type": "string",
|
|
"enum": ["aws-secrets-manager", "gcp-secret-manager", "hashicorp-vault"]
|
|
},
|
|
"prefix": {
|
|
"type": "string"
|
|
},
|
|
"accessMode": {
|
|
"type": "string",
|
|
"enum": ["read_only", "read_and_write"]
|
|
},
|
|
"aws": {
|
|
"type": "object",
|
|
"description": "AWS Secrets Manager configuration",
|
|
"properties": {
|
|
"region": { "type": "string" },
|
|
"accessKeyId": { "type": "string" },
|
|
"secretAccessKey": { "type": "string" },
|
|
"sessionToken": { "type": "string" },
|
|
"roleArn": { "type": "string" },
|
|
"kmsKeyId": { "type": "string" }
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"gcp": {
|
|
"type": "object",
|
|
"description": "GCP Secret Manager configuration",
|
|
"properties": {
|
|
"projectId": { "type": "string" },
|
|
"credentialsJson": { "type": "string" }
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"hashicorp": {
|
|
"type": "object",
|
|
"description": "HashiCorp Vault (KV v2) configuration",
|
|
"properties": {
|
|
"address": { "type": "string" },
|
|
"token": { "type": "string" },
|
|
"namespace": { "type": "string" },
|
|
"mountPath": { "type": "string" },
|
|
"roleId": { "type": "string" },
|
|
"secretId": { "type": "string" }
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"logsStore": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"type": {
|
|
"type": "string",
|
|
"enum": ["", "sqlite", "postgres", "clickhouse"]
|
|
},
|
|
"maxIdleConns": {
|
|
"type": "integer",
|
|
"minimum": 0
|
|
},
|
|
"maxOpenConns": {
|
|
"type": "integer",
|
|
"minimum": 2
|
|
},
|
|
"matviewRefreshInterval": {
|
|
"type": "string",
|
|
"description": "How often to refresh materialized views. Go duration string (e.g. '30s', '5m', '1h'). Minimum 5s.",
|
|
"pattern": "^[0-9]+(ns|us|µs|ms|s|m|h)$"
|
|
},
|
|
"clickhouse": {
|
|
"type": "object",
|
|
"description": "ClickHouse connection settings (only applies when type is clickhouse)",
|
|
"properties": {
|
|
"host": {
|
|
"type": "string",
|
|
"description": "ClickHouse host"
|
|
},
|
|
"port": {
|
|
"type": ["string", "integer"],
|
|
"description": "ClickHouse port. Defaults by protocol: native 9000 (9440 TLS), http 8123 (8443 TLS)"
|
|
},
|
|
"database": {
|
|
"type": "string",
|
|
"description": "ClickHouse database name (default: default)"
|
|
},
|
|
"username": {
|
|
"type": "string",
|
|
"description": "ClickHouse username"
|
|
},
|
|
"password": {
|
|
"type": "string",
|
|
"description": "ClickHouse password (can use env. prefix)"
|
|
},
|
|
"protocol": {
|
|
"type": "string",
|
|
"enum": ["native", "http"],
|
|
"description": "ClickHouse wire protocol (default: native)"
|
|
},
|
|
"secure": {
|
|
"type": "boolean",
|
|
"description": "Enable TLS (native: secure=true; http: switches to https)"
|
|
},
|
|
"dialTimeout": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Connection dial timeout in milliseconds (default: 10000)"
|
|
},
|
|
"cluster": {
|
|
"type": "string",
|
|
"description": "Optional cluster name; when set, DDL runs ON CLUSTER with replicated table engines"
|
|
}
|
|
},
|
|
"required": ["host"],
|
|
"additionalProperties": false
|
|
},
|
|
"writer": {
|
|
"type": "object",
|
|
"description": "Async logging writer queue and batch tuning",
|
|
"properties": {
|
|
"maxBatchSize": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"batchInterval": {
|
|
"type": "string",
|
|
"pattern": "^[1-9][0-9]*(ns|us|µs|ms|s|m|h)$"
|
|
},
|
|
"maxBatchBytes": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"writeQueueCapacity": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"deferredUsageConcurrency": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"objectStorageExcludeFields": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"objectStorage": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"type": {
|
|
"type": "string",
|
|
"enum": ["s3", "gcs"]
|
|
},
|
|
"bucket": {
|
|
"type": "string"
|
|
},
|
|
"prefix": {
|
|
"type": "string"
|
|
},
|
|
"compress": {
|
|
"type": "boolean"
|
|
},
|
|
"region": {
|
|
"type": "string"
|
|
},
|
|
"endpoint": {
|
|
"type": "string"
|
|
},
|
|
"accessKeyId": {
|
|
"type": "string"
|
|
},
|
|
"secretAccessKey": {
|
|
"type": "string"
|
|
},
|
|
"sessionToken": {
|
|
"type": "string"
|
|
},
|
|
"roleArn": {
|
|
"type": "string"
|
|
},
|
|
"forcePathStyle": {
|
|
"type": "boolean"
|
|
},
|
|
"projectId": {
|
|
"type": "string"
|
|
},
|
|
"credentialsJson": {
|
|
"type": "string"
|
|
},
|
|
"existingSecret": {
|
|
"type": "string"
|
|
},
|
|
"accessKeyIdKey": {
|
|
"type": "string"
|
|
},
|
|
"secretAccessKeyKey": {
|
|
"type": "string"
|
|
},
|
|
"sessionTokenKey": {
|
|
"type": "string"
|
|
},
|
|
"roleArnKey": {
|
|
"type": "string"
|
|
},
|
|
"credentialsJsonKey": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": ["enabled"]
|
|
},
|
|
"then": {
|
|
"required": ["type", "bucket"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"postgresql": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"external": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"host": {
|
|
"type": "string"
|
|
},
|
|
"port": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 65535
|
|
},
|
|
"user": {
|
|
"type": "string"
|
|
},
|
|
"password": {
|
|
"type": "string"
|
|
},
|
|
"passwordCommand": {
|
|
"type": "object",
|
|
"description": "Command executed by Bifrost to produce the PostgreSQL password on stdout for each new physical connection",
|
|
"properties": {
|
|
"command": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"pattern": "^\\S+$"
|
|
},
|
|
"args": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"timeout": {
|
|
"type": "string",
|
|
"pattern": "^[1-9][0-9]*(ns|us|µs|ms|s|m|h)$"
|
|
}
|
|
},
|
|
"required": ["command"],
|
|
"additionalProperties": false
|
|
},
|
|
"connMaxLifetime": {
|
|
"type": "string",
|
|
"pattern": "^[1-9][0-9]*(ns|us|µs|ms|s|m|h)$"
|
|
},
|
|
"database": {
|
|
"type": "string"
|
|
},
|
|
"sslMode": {
|
|
"type": "string",
|
|
"enum": ["disable", "allow", "prefer", "require", "verify-ca", "verify-full"]
|
|
},
|
|
"existingSecret": {
|
|
"type": "string"
|
|
},
|
|
"passwordKey": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["host", "port", "user", "database", "sslMode"]
|
|
}
|
|
},
|
|
{
|
|
"not": {
|
|
"required": ["password", "passwordCommand"]
|
|
}
|
|
},
|
|
{
|
|
"not": {
|
|
"required": ["existingSecret", "passwordCommand"]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"image": {
|
|
"type": "object",
|
|
"properties": {
|
|
"repository": {
|
|
"type": "string"
|
|
},
|
|
"tag": {
|
|
"type": "string"
|
|
},
|
|
"pullPolicy": {
|
|
"type": "string",
|
|
"enum": ["Always", "IfNotPresent", "Never"]
|
|
}
|
|
}
|
|
},
|
|
"auth": {
|
|
"type": "object",
|
|
"properties": {
|
|
"username": {
|
|
"type": "string"
|
|
},
|
|
"password": {
|
|
"type": "string"
|
|
},
|
|
"database": {
|
|
"type": "string"
|
|
},
|
|
"existingSecret": {
|
|
"type": "string"
|
|
},
|
|
"passwordKey": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"primary": {
|
|
"type": "object",
|
|
"properties": {
|
|
"persistence": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"size": {
|
|
"type": "string"
|
|
},
|
|
"storageClass": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"resources": {
|
|
"type": "object"
|
|
},
|
|
"podSecurityContext": {
|
|
"type": "object"
|
|
},
|
|
"containerSecurityContext": {
|
|
"type": "object"
|
|
},
|
|
"nodeSelector": {
|
|
"type": "object"
|
|
},
|
|
"tolerations": {
|
|
"type": "array",
|
|
"items": { "type": "object" }
|
|
},
|
|
"affinity": {
|
|
"type": "object"
|
|
}
|
|
}
|
|
},
|
|
"metrics": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"vectorStore": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"type": {
|
|
"type": "string",
|
|
"enum": ["none", "weaviate", "redis", "qdrant", "pinecone"]
|
|
},
|
|
"weaviate": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"external": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"scheme": {
|
|
"type": "string",
|
|
"enum": ["http", "https"]
|
|
},
|
|
"host": {
|
|
"type": "string",
|
|
"description": "Weaviate server host (host:port)"
|
|
},
|
|
"apiKey": {
|
|
"type": "string",
|
|
"description": "API key for Weaviate authentication"
|
|
},
|
|
"grpcHost": {
|
|
"type": "string",
|
|
"description": "Weaviate gRPC host (host:port)"
|
|
},
|
|
"grpcSecured": {
|
|
"type": "boolean",
|
|
"description": "Whether gRPC connection is secured"
|
|
},
|
|
"timeout": {
|
|
"type": "string",
|
|
"pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$",
|
|
"description": "Timeout for Weaviate operations (e.g., '5s')"
|
|
},
|
|
"className": {
|
|
"type": "string",
|
|
"description": "Class name for Weaviate vector store"
|
|
},
|
|
"existingSecret": {
|
|
"type": "string"
|
|
},
|
|
"apiKeyKey": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["scheme", "host"]
|
|
}
|
|
},
|
|
"replicas": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"image": {
|
|
"type": "object"
|
|
},
|
|
"persistence": {
|
|
"type": "object"
|
|
},
|
|
"resources": {
|
|
"type": "object"
|
|
},
|
|
"env": {
|
|
"type": "object"
|
|
}
|
|
}
|
|
},
|
|
"redis": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"external": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"host": {
|
|
"type": "string",
|
|
"description": "Redis/Valkey server host"
|
|
},
|
|
"port": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 65535,
|
|
"description": "Redis/Valkey server port"
|
|
},
|
|
"username": {
|
|
"type": "string",
|
|
"description": "Username for Redis/Valkey AUTH"
|
|
},
|
|
"password": {
|
|
"type": "string",
|
|
"description": "Password for Redis/Valkey AUTH"
|
|
},
|
|
"database": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"default": 0,
|
|
"description": "Redis/Valkey database number"
|
|
},
|
|
"useTls": {
|
|
"type": "boolean",
|
|
"default": false,
|
|
"description": "Enable TLS for the Redis/Valkey connection"
|
|
},
|
|
"insecureSkipVerify": {
|
|
"type": "boolean",
|
|
"default": false,
|
|
"description": "Skip TLS certificate verification for Redis/Valkey connections"
|
|
},
|
|
"caCertPem": {
|
|
"type": "string",
|
|
"description": "PEM-encoded CA certificate to trust for Redis/Valkey TLS connections"
|
|
},
|
|
"clusterMode": {
|
|
"type": "boolean",
|
|
"default": false,
|
|
"description": "Use Redis Cluster mode for cluster configuration endpoints"
|
|
},
|
|
"poolSize": {
|
|
"type": "integer",
|
|
"description": "Maximum number of socket connections"
|
|
},
|
|
"maxActiveConns": {
|
|
"type": "integer",
|
|
"description": "Maximum number of active connections"
|
|
},
|
|
"minIdleConns": {
|
|
"type": "integer",
|
|
"description": "Minimum number of idle connections"
|
|
},
|
|
"maxIdleConns": {
|
|
"type": "integer",
|
|
"description": "Maximum number of idle connections"
|
|
},
|
|
"connMaxLifetime": {
|
|
"type": "string",
|
|
"pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$",
|
|
"description": "Connection maximum lifetime (e.g., '30m')"
|
|
},
|
|
"connMaxIdleTime": {
|
|
"type": "string",
|
|
"pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$",
|
|
"description": "Connection maximum idle time (e.g., '5m')"
|
|
},
|
|
"dialTimeout": {
|
|
"type": "string",
|
|
"pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$",
|
|
"description": "Timeout for socket connection (e.g., '5s')"
|
|
},
|
|
"readTimeout": {
|
|
"type": "string",
|
|
"pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$",
|
|
"description": "Timeout for socket reads (e.g., '3s')"
|
|
},
|
|
"writeTimeout": {
|
|
"type": "string",
|
|
"pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$",
|
|
"description": "Timeout for socket writes (e.g., '3s')"
|
|
},
|
|
"contextTimeout": {
|
|
"type": "string",
|
|
"pattern": "^[0-9]+(ns|us|\u00b5s|ms|s|m|h)$",
|
|
"description": "Timeout for Redis/Valkey operations (e.g., '10s')"
|
|
},
|
|
"existingSecret": {
|
|
"type": "string"
|
|
},
|
|
"passwordKey": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["host"]
|
|
}
|
|
},
|
|
"image": {
|
|
"type": "object"
|
|
},
|
|
"auth": {
|
|
"type": "object"
|
|
},
|
|
"master": {
|
|
"type": "object"
|
|
},
|
|
"metrics": {
|
|
"type": "object"
|
|
}
|
|
}
|
|
},
|
|
"qdrant": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"external": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"host": {
|
|
"type": "string",
|
|
"description": "Qdrant server host"
|
|
},
|
|
"port": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 65535,
|
|
"default": 6334,
|
|
"description": "Qdrant server port (default: 6334 for gRPC)"
|
|
},
|
|
"apiKey": {
|
|
"type": "string",
|
|
"description": "API key for authentication"
|
|
},
|
|
"useTls": {
|
|
"type": "boolean",
|
|
"default": false,
|
|
"description": "Use TLS for connection"
|
|
},
|
|
"existingSecret": {
|
|
"type": "string"
|
|
},
|
|
"apiKeyKey": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["host"]
|
|
}
|
|
},
|
|
"image": {
|
|
"type": "object"
|
|
},
|
|
"persistence": {
|
|
"type": "object"
|
|
},
|
|
"resources": {
|
|
"type": "object"
|
|
}
|
|
}
|
|
},
|
|
"pinecone": {
|
|
"type": "object",
|
|
"description": "Pinecone configuration for vector store",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"external": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"apiKey": {
|
|
"type": "string",
|
|
"description": "Pinecone API key"
|
|
},
|
|
"indexHost": {
|
|
"type": "string",
|
|
"description": "Index host URL from Pinecone console (e.g., your-index.svc.environment.pinecone.io)"
|
|
},
|
|
"existingSecret": {
|
|
"type": "string",
|
|
"description": "Name of existing secret containing Pinecone API key"
|
|
},
|
|
"apiKeyKey": {
|
|
"type": "string",
|
|
"description": "Key in the secret containing the API key"
|
|
}
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["indexHost"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"env": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"type": "string"
|
|
},
|
|
"valueFrom": {
|
|
"type": "object"
|
|
}
|
|
},
|
|
"required": ["name"]
|
|
}
|
|
},
|
|
"envFrom": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object"
|
|
}
|
|
},
|
|
"initContainers": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object"
|
|
}
|
|
}
|
|
},
|
|
"$defs": {
|
|
"otelEndpoint": {
|
|
"type": "string",
|
|
"description": "OpenTelemetry endpoint URL or host:port. Supports env.VAR_NAME prefix for environment variable substitution.",
|
|
"anyOf": [
|
|
{
|
|
"format": "uri"
|
|
},
|
|
{
|
|
"pattern": "^[^:\\s]+:\\d+$"
|
|
},
|
|
{
|
|
"pattern": "^env\\.[A-Za-z_][A-Za-z0-9_]*$"
|
|
},
|
|
{
|
|
"const": ""
|
|
}
|
|
]
|
|
},
|
|
"pluginSpanFilter": {
|
|
"type": "object",
|
|
"description": "Controls which plugin hook spans this observability connector exports. Omit to export all plugin spans. Mode \"include\" exports only the listed plugins; mode \"exclude\" exports everything except them.",
|
|
"properties": {
|
|
"mode": {
|
|
"type": "string",
|
|
"enum": ["include", "exclude"]
|
|
},
|
|
"plugins": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"required": ["mode", "plugins"],
|
|
"additionalProperties": false
|
|
},
|
|
"otelProfileConfig": {
|
|
"type": "object",
|
|
"description": "OpenTelemetry export profile. This legacy single-profile shape is still accepted directly as bifrost.plugins.otel.config.",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether this profile exports traces and metrics",
|
|
"default": true
|
|
},
|
|
"service_name": {
|
|
"type": "string",
|
|
"description": "Service name to be used for tracing",
|
|
"default": "bifrost"
|
|
},
|
|
"collector_url": {
|
|
"$ref": "#/$defs/otelEndpoint",
|
|
"description": "URL of the OpenTelemetry collector"
|
|
},
|
|
"trace_type": {
|
|
"type": "string",
|
|
"enum": ["genai_extension", "vercel", "open_inference"],
|
|
"description": "Type of trace to use for the OTEL collector"
|
|
},
|
|
"protocol": {
|
|
"type": "string",
|
|
"enum": ["http", "grpc"],
|
|
"description": "Protocol to use for the OTEL collector"
|
|
},
|
|
"metrics_enabled": {
|
|
"type": "boolean",
|
|
"description": "Enable push-based metrics export via OTLP. Recommended for multi-node cluster deployments.",
|
|
"default": false
|
|
},
|
|
"metrics_endpoint": {
|
|
"$ref": "#/$defs/otelEndpoint",
|
|
"description": "OTLP metrics endpoint URL (e.g., http://otel-collector:4318/v1/metrics for HTTP or otel-collector:4317 for gRPC)"
|
|
},
|
|
"metrics_push_interval": {
|
|
"type": "integer",
|
|
"description": "Metrics push interval in seconds",
|
|
"default": 15,
|
|
"minimum": 1,
|
|
"maximum": 300
|
|
},
|
|
"headers": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Custom headers for the collector (supports env.VAR_NAME prefix)"
|
|
},
|
|
"tls_ca_cert": {
|
|
"type": "string",
|
|
"description": "Path to TLS CA certificate file"
|
|
},
|
|
"insecure": {
|
|
"type": "boolean",
|
|
"description": "Skip TLS verification (ignored if tls_ca_cert is set)",
|
|
"default": false
|
|
},
|
|
"disable_content_logging": {
|
|
"type": "boolean",
|
|
"description": "When true, message content (input/output messages, embeddings, tool definitions, and tool call arguments/results) is dropped from exported spans. Only metadata such as model, tokens, and latency is sent to the collector.",
|
|
"default": false
|
|
},
|
|
"group_traces_by_session": {
|
|
"type": "boolean",
|
|
"description": "When true, requests sharing the same x-bf-session-id header are grouped into a single OTEL trace, each request's root span appearing as a top-level sibling. An inbound W3C traceparent takes precedence, leaving that request on its own distributed trace.",
|
|
"default": false
|
|
},
|
|
"disable_root_span_content": {
|
|
"type": "boolean",
|
|
"description": "When true, input/output message content is dropped from the root span only; the underlying generation (llm.call) span retains the full content. This removes the duplicate input/output stored at the trace level (e.g. the Langfuse trace Input/Output goes empty) to reduce downstream storage.",
|
|
"default": false
|
|
},
|
|
"plugin_span_filter": {
|
|
"$ref": "#/$defs/pluginSpanFilter"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"not": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": false
|
|
}
|
|
},
|
|
"required": ["enabled"]
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["collector_url", "trace_type", "protocol"]
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"metrics_enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": ["metrics_enabled"]
|
|
},
|
|
"then": {
|
|
"required": ["metrics_endpoint"]
|
|
}
|
|
}
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"otelProfilesConfig": {
|
|
"type": "object",
|
|
"description": "OpenTelemetry plugin configuration with one or more export profiles.",
|
|
"properties": {
|
|
"profiles": {
|
|
"type": "array",
|
|
"description": "OpenTelemetry export profiles",
|
|
"items": {
|
|
"$ref": "#/$defs/otelProfileConfig"
|
|
},
|
|
"minItems": 1
|
|
},
|
|
"plugin_span_filter": {
|
|
"$ref": "#/$defs/pluginSpanFilter"
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Deprecated in the profiles wrapper; kept only so Helm's default map merge does not reject values that switch from the legacy shape to profiles."
|
|
},
|
|
"service_name": {
|
|
"type": "string",
|
|
"description": "Deprecated in the profiles wrapper; configure service_name per profile instead."
|
|
},
|
|
"collector_url": {
|
|
"$ref": "#/$defs/otelEndpoint",
|
|
"description": "Deprecated in the profiles wrapper; configure collector_url per profile instead."
|
|
},
|
|
"trace_type": {
|
|
"type": "string",
|
|
"enum": ["genai_extension", "vercel", "open_inference"],
|
|
"description": "Deprecated in the profiles wrapper; configure trace_type per profile instead."
|
|
},
|
|
"protocol": {
|
|
"type": "string",
|
|
"enum": ["http", "grpc"],
|
|
"description": "Deprecated in the profiles wrapper; configure protocol per profile instead."
|
|
},
|
|
"metrics_enabled": {
|
|
"type": "boolean",
|
|
"description": "Deprecated in the profiles wrapper; configure metrics_enabled per profile instead."
|
|
},
|
|
"metrics_endpoint": {
|
|
"$ref": "#/$defs/otelEndpoint",
|
|
"description": "Deprecated in the profiles wrapper; configure metrics_endpoint per profile instead."
|
|
},
|
|
"metrics_push_interval": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 300,
|
|
"description": "Deprecated in the profiles wrapper; configure metrics_push_interval per profile instead."
|
|
},
|
|
"headers": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Deprecated in the profiles wrapper; configure headers per profile instead."
|
|
},
|
|
"tls_ca_cert": {
|
|
"type": "string",
|
|
"description": "Deprecated in the profiles wrapper; configure tls_ca_cert per profile instead."
|
|
},
|
|
"insecure": {
|
|
"type": "boolean",
|
|
"description": "Deprecated in the profiles wrapper; configure insecure per profile instead."
|
|
},
|
|
"disable_content_logging": {
|
|
"type": "boolean",
|
|
"description": "Deprecated in the profiles wrapper; configure disable_content_logging per profile instead."
|
|
},
|
|
"group_traces_by_session": {
|
|
"type": "boolean",
|
|
"description": "Deprecated in the profiles wrapper; configure group_traces_by_session per profile instead."
|
|
},
|
|
"disable_root_span_content": {
|
|
"type": "boolean",
|
|
"description": "Deprecated in the profiles wrapper; configure disable_root_span_content per profile instead."
|
|
}
|
|
},
|
|
"required": ["profiles"],
|
|
"additionalProperties": false
|
|
},
|
|
"authConfig": {
|
|
"type": "object",
|
|
"description": "Authentication configuration. Deprecated: Use governance.auth_config instead.",
|
|
"properties": {
|
|
"adminUsername": {
|
|
"type": "string",
|
|
"description": "Admin username"
|
|
},
|
|
"adminPassword": {
|
|
"type": "string",
|
|
"description": "Admin password"
|
|
},
|
|
"isEnabled": {
|
|
"type": "boolean",
|
|
"description": "Whether authentication is enabled"
|
|
},
|
|
"disableAuthOnInference": {
|
|
"type": "boolean",
|
|
"deprecated": true,
|
|
"description": "Deprecated and ignored. Use client.enforceAuthOnInference instead."
|
|
},
|
|
"existingSecret": {
|
|
"type": "string"
|
|
},
|
|
"usernameKey": {
|
|
"type": "string"
|
|
},
|
|
"passwordKey": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"pluginBase": {
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"config": {
|
|
"type": "object"
|
|
}
|
|
}
|
|
},
|
|
"provider": {
|
|
"type": "object",
|
|
"properties": {
|
|
"keys": {
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/$defs/providerKey"
|
|
},
|
|
"minItems": 1
|
|
},
|
|
"network_config": {
|
|
"$ref": "#/$defs/networkConfig"
|
|
},
|
|
"concurrency_and_buffer_size": {
|
|
"$ref": "#/$defs/concurrencyConfig"
|
|
},
|
|
"proxy_config": {
|
|
"$ref": "#/$defs/proxyConfig"
|
|
},
|
|
"send_back_raw_request": {
|
|
"type": "boolean",
|
|
"description": "Include raw request in BifrostResponse"
|
|
},
|
|
"send_back_raw_response": {
|
|
"type": "boolean"
|
|
},
|
|
"store_raw_request_response": {
|
|
"type": "boolean",
|
|
"description": "Capture raw request/response for plugins only; stripped before returning to client"
|
|
},
|
|
"custom_provider_config": {
|
|
"type": "object",
|
|
"description": "Custom provider configuration",
|
|
"properties": {
|
|
"is_key_less": {
|
|
"type": "boolean"
|
|
},
|
|
"base_provider_type": {
|
|
"type": "string"
|
|
},
|
|
"allowed_requests": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"request_path_overrides": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"required": ["base_provider_type"]
|
|
},
|
|
"pricing_overrides": {
|
|
"type": "array",
|
|
"description": "Provider-level pricing overrides",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"model_pattern": {
|
|
"type": "string"
|
|
},
|
|
"match_type": {
|
|
"type": "string",
|
|
"enum": ["exact", "wildcard", "regex"]
|
|
}
|
|
},
|
|
"required": ["model_pattern", "match_type"]
|
|
}
|
|
}
|
|
},
|
|
"required": ["keys"]
|
|
},
|
|
"providerKey": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"type": "string"
|
|
},
|
|
"models": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"weight": {
|
|
"type": "number",
|
|
"minimum": 0,
|
|
"default": 1,
|
|
"description": "Routing weight for this key. Optional; defaults to 1 when omitted."
|
|
},
|
|
"use_for_batch_api": {
|
|
"type": "boolean"
|
|
},
|
|
"azure_key_config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"endpoint": {
|
|
"type": "string",
|
|
"description": "Azure endpoint (can use env. prefix)"
|
|
},
|
|
"client_id": {
|
|
"type": "string",
|
|
"description": "Azure client ID for authentication (can use env. prefix)"
|
|
},
|
|
"client_secret": {
|
|
"type": "string",
|
|
"description": "Azure client secret for authentication (can use env. prefix)"
|
|
},
|
|
"tenant_id": {
|
|
"type": "string",
|
|
"description": "Azure tenant ID for authentication (can use env. prefix)"
|
|
},
|
|
"scopes": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Azure scopes for authentication"
|
|
},
|
|
"deployments": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Model to deployment mappings"
|
|
},
|
|
"api_version": {
|
|
"type": "string",
|
|
"description": "Azure API version"
|
|
}
|
|
},
|
|
"required": ["endpoint"],
|
|
"dependentRequired": {
|
|
"client_id": ["client_secret", "tenant_id"],
|
|
"client_secret": ["client_id", "tenant_id"],
|
|
"tenant_id": ["client_id", "client_secret"]
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"vertex_key_config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"project_id": {
|
|
"type": "string",
|
|
"description": "Google Cloud project ID (can use env. prefix)"
|
|
},
|
|
"project_number": {
|
|
"type": "string",
|
|
"description": "Google Cloud project number"
|
|
},
|
|
"region": {
|
|
"type": "string",
|
|
"description": "Google Cloud region"
|
|
},
|
|
"auth_credentials": {
|
|
"type": "string",
|
|
"description": "Authentication credentials (can use env. prefix)"
|
|
},
|
|
"deployments": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Model to deployment mappings"
|
|
}
|
|
},
|
|
"required": ["project_id", "region"],
|
|
"additionalProperties": false
|
|
},
|
|
"bedrock_key_config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"access_key": {
|
|
"type": "string",
|
|
"description": "AWS access key (can use env. prefix)"
|
|
},
|
|
"secret_key": {
|
|
"type": "string",
|
|
"description": "AWS secret key (can use env. prefix)"
|
|
},
|
|
"session_token": {
|
|
"type": "string",
|
|
"description": "AWS session token (can use env. prefix)"
|
|
},
|
|
"region": {
|
|
"type": "string",
|
|
"description": "AWS region"
|
|
},
|
|
"arn": {
|
|
"type": "string",
|
|
"description": "AWS ARN"
|
|
},
|
|
"role_arn": {
|
|
"type": "string",
|
|
"description": "AWS IAM role ARN for AssumeRole (can use env. prefix)"
|
|
},
|
|
"external_id": {
|
|
"type": "string",
|
|
"description": "External ID for AssumeRole (can use env. prefix)"
|
|
},
|
|
"session_name": {
|
|
"type": "string",
|
|
"description": "Role session name for AssumeRole (can use env. prefix)"
|
|
},
|
|
"deployments": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Model to deployment mappings"
|
|
},
|
|
"batch_s3_config": {
|
|
"type": "object",
|
|
"description": "S3 bucket configuration for Bedrock batch operations",
|
|
"properties": {
|
|
"buckets": {
|
|
"type": "array",
|
|
"description": "List of S3 bucket configurations",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"bucket_name": {
|
|
"type": "string",
|
|
"description": "S3 bucket name"
|
|
},
|
|
"prefix": {
|
|
"type": "string",
|
|
"description": "S3 key prefix for batch files"
|
|
},
|
|
"is_default": {
|
|
"type": "boolean",
|
|
"description": "Whether this is the default bucket for batch operations"
|
|
}
|
|
},
|
|
"required": ["bucket_name"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"required": ["region"],
|
|
"additionalProperties": false
|
|
},
|
|
"bedrock_mantle_key_config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"access_key": {
|
|
"type": "string",
|
|
"description": "AWS access key for SigV4 (can use env. prefix)"
|
|
},
|
|
"secret_key": {
|
|
"type": "string",
|
|
"description": "AWS secret key for SigV4 (can use env. prefix)"
|
|
},
|
|
"session_token": {
|
|
"type": "string",
|
|
"description": "AWS session token for temporary credentials (can use env. prefix)"
|
|
},
|
|
"region": {
|
|
"type": "string",
|
|
"description": "AWS region used to build the bedrock-mantle endpoint host"
|
|
},
|
|
"role_arn": {
|
|
"type": "string",
|
|
"description": "AWS IAM role ARN for AssumeRole (can use env. prefix)"
|
|
},
|
|
"external_id": {
|
|
"type": "string",
|
|
"description": "External ID for AssumeRole (can use env. prefix)"
|
|
},
|
|
"session_name": {
|
|
"type": "string",
|
|
"description": "Role session name for AssumeRole (can use env. prefix)"
|
|
}
|
|
},
|
|
"required": ["region"],
|
|
"additionalProperties": false
|
|
},
|
|
"vllm_key_config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"url": {
|
|
"type": "string",
|
|
"description": "VLLM server base URL (can use env. prefix)"
|
|
},
|
|
"model_name": {
|
|
"type": "string",
|
|
"description": "Exact model name served on this VLLM instance"
|
|
}
|
|
},
|
|
"required": ["url", "model_name"],
|
|
"additionalProperties": false
|
|
},
|
|
"aliases": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"oneOf": [
|
|
{
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "Legacy shape: a bare provider-specific identifier. Equivalent to {\"model_id\": \"<value>\"}."
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"model_id": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "Provider-specific identifier sent on the wire (deployment name, inference profile ID, fine-tuned model ID, etc.)."
|
|
},
|
|
"model_name": {
|
|
"type": "string",
|
|
"description": "Canonical model name used for pricing, logging, and family inference."
|
|
},
|
|
"model_family": {
|
|
"type": "string",
|
|
"enum": ["anthropic", "openai", "mistral", "cohere", "gemini", "nova", "titan"],
|
|
"description": "Underlying model family. Used by provider routing without substring-sniffing the wire model ID."
|
|
},
|
|
"description": {
|
|
"type": "string"
|
|
},
|
|
"region": {
|
|
"type": "string",
|
|
"description": "Per-alias region override (can use env. prefix)."
|
|
},
|
|
"api_version": {
|
|
"type": "string",
|
|
"description": "Azure OpenAI api-version override for this alias."
|
|
},
|
|
"anthropic_version": {
|
|
"type": "string",
|
|
"description": "Azure anthropic-version header override for Claude-on-Azure deployments."
|
|
},
|
|
"endpoint": {
|
|
"type": "string",
|
|
"description": "Per-alias Azure endpoint override (can use env. prefix)."
|
|
},
|
|
"project_id": {
|
|
"type": "string",
|
|
"description": "Per-alias Vertex project ID override (can use env. prefix)."
|
|
},
|
|
"project_number": {
|
|
"type": "string",
|
|
"description": "Per-alias Vertex project number override (can use env. prefix)."
|
|
},
|
|
"inference_profile_arn": {
|
|
"type": "string",
|
|
"description": "Per-alias Bedrock inference profile ARN (can use env. prefix)."
|
|
},
|
|
"use_deployments_endpoint": {
|
|
"type": "boolean",
|
|
"description": "Replicate: use the deployments endpoint instead of the predictions endpoint for this alias."
|
|
}
|
|
},
|
|
"required": ["model_id"],
|
|
"additionalProperties": false
|
|
}
|
|
]
|
|
},
|
|
"propertyNames": {
|
|
"minLength": 1
|
|
},
|
|
"description": "Model alias mappings: each entry maps a user-facing model name to either a bare provider identifier (legacy string shape) or an AliasConfig object carrying the wire identifier plus optional canonical name, family, and provider-specific overrides."
|
|
}
|
|
},
|
|
"required": ["name", "weight"],
|
|
"oneOf": [
|
|
{
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["azure_key_config"]
|
|
},
|
|
{
|
|
"required": ["vertex_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_mantle_key_config"]
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": ["azure_key_config"],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["vertex_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_mantle_key_config"]
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": ["vertex_key_config"],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["azure_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_mantle_key_config"]
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["azure_key_config"]
|
|
},
|
|
{
|
|
"required": ["vertex_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_mantle_key_config"]
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": ["bedrock_mantle_key_config"],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["azure_key_config"]
|
|
},
|
|
{
|
|
"required": ["vertex_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"]
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["azure_key_config"]
|
|
},
|
|
{
|
|
"required": ["vertex_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_mantle_key_config"]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"networkConfig": {
|
|
"type": "object",
|
|
"properties": {
|
|
"base_url": {
|
|
"type": "string",
|
|
"format": "uri",
|
|
"description": "Base URL for the provider (optional, required for Ollama)"
|
|
},
|
|
"extra_headers": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Additional headers to send with requests"
|
|
},
|
|
"default_request_timeout_in_seconds": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Default request timeout in seconds"
|
|
},
|
|
"max_retries": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"description": "Maximum number of retries"
|
|
},
|
|
"retry_backoff_initial_ms": {
|
|
"type": "integer",
|
|
"minimum": 100,
|
|
"description": "Initial retry backoff in milliseconds"
|
|
},
|
|
"retry_backoff_max_ms": {
|
|
"type": "integer",
|
|
"minimum": 100,
|
|
"description": "Maximum retry backoff in milliseconds"
|
|
},
|
|
"insecure_skip_verify": {
|
|
"type": "boolean",
|
|
"description": "Disable TLS certificate verification for provider connections. This bypasses server certificate validation and should be used only as a last resort when a trusted CA chain cannot be configured. Prefer ca_cert_pem for self-signed or private CA deployments."
|
|
},
|
|
"ca_cert_pem": {
|
|
"type": "string",
|
|
"description": "PEM-encoded CA certificate to trust for provider endpoint connections (e.g. self-signed or internal CA). Supports inline PEM or env.VAR_NAME."
|
|
},
|
|
"stream_idle_timeout_in_seconds": {
|
|
"type": "integer",
|
|
"minimum": 5,
|
|
"maximum": 3600,
|
|
"description": "Idle timeout per stream chunk in seconds. If no data is received for this many seconds, the stream is closed. Default: 60."
|
|
},
|
|
"max_conns_per_host": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 10000,
|
|
"description": "Maximum number of TCP connections per provider host. For HTTP/2 (e.g. Bedrock), each connection supports ~100 concurrent streams. Default: 5000."
|
|
},
|
|
"enforce_http2": {
|
|
"type": "boolean",
|
|
"description": "Force HTTP/2 on provider connections (relevant for Bedrock and other net/http-based providers)"
|
|
},
|
|
"beta_header_overrides": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "boolean"
|
|
},
|
|
"description": "Override default Anthropic beta header support per provider. Keys are header prefixes (e.g. 'redact-thinking-'), values are true (supported) or false (unsupported). Headers not listed use the built-in defaults."
|
|
},
|
|
"allow_private_network": {
|
|
"type": "boolean",
|
|
"description": "Allow connections to RFC 1918 private IPs (10.x, 172.16.x, 192.168.x). Enable for providers on a k8s pod network, LAN, or private VPC. Loopback addresses (localhost, 127.0.0.1, ::1) remain allowed regardless of this setting. Link-local addresses (169.254.x.x) are always blocked.",
|
|
"default": false
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"concurrencyConfig": {
|
|
"type": "object",
|
|
"properties": {
|
|
"concurrency": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Number of concurrent requests"
|
|
},
|
|
"buffer_size": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "Buffer size for requests"
|
|
}
|
|
},
|
|
"required": ["concurrency", "buffer_size"],
|
|
"additionalProperties": false
|
|
},
|
|
"proxyConfig": {
|
|
"type": "object",
|
|
"description": "Proxy configuration for provider connections",
|
|
"properties": {
|
|
"type": {
|
|
"type": "string",
|
|
"enum": ["none", "http", "socks5", "environment"],
|
|
"description": "Type of proxy to use"
|
|
},
|
|
"url": {
|
|
"oneOf": [
|
|
{
|
|
"type": "string",
|
|
"pattern": "^env\\.[A-Za-z_][A-Za-z0-9_]*$"
|
|
},
|
|
{
|
|
"type": "string",
|
|
"format": "uri",
|
|
"not": { "pattern": "^env\\.[A-Za-z_][A-Za-z0-9_]*$" }
|
|
}
|
|
],
|
|
"description": "URL of the proxy server (supports env.VAR_NAME or a literal URI)"
|
|
},
|
|
"username": {
|
|
"type": "string",
|
|
"description": "Username for proxy authentication (supports env.VAR_NAME)"
|
|
},
|
|
"password": {
|
|
"type": "string",
|
|
"description": "Password for proxy authentication (supports env.VAR_NAME)"
|
|
},
|
|
"ca_cert_pem": {
|
|
"type": "string",
|
|
"description": "PEM-encoded CA certificate to trust for TLS connections through the proxy (for SSL-intercepting proxies, supports env.VAR_NAME)"
|
|
}
|
|
},
|
|
"required": ["type"],
|
|
"additionalProperties": false
|
|
},
|
|
"mcpClientConfig": {
|
|
"type": "object",
|
|
"properties": {
|
|
"clientId": {
|
|
"type": "string",
|
|
"description": "MCP client identifier"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"isCodeModeClient": {
|
|
"type": "boolean",
|
|
"description": "Whether this client is a code mode client"
|
|
},
|
|
"connectionType": {
|
|
"type": "string",
|
|
"enum": ["stdio", "websocket", "http", "sse"]
|
|
},
|
|
"connectionString": {
|
|
"type": "string",
|
|
"description": "HTTP or SSE URL (required for HTTP or SSE connections)"
|
|
},
|
|
"secretRef": {
|
|
"type": "object",
|
|
"description": "Reference to an existing Kubernetes secret holding the MCP connection_string. Chart injects BIFROST_MCP_<NAME>_CONNECTION_STRING and rewrites connection_string in config.json.",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"connectionStringKey": {
|
|
"type": "string",
|
|
"default": "connection-string"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"authType": {
|
|
"type": "string",
|
|
"enum": ["none", "headers", "oauth", "per_user_oauth", "per_user_headers"],
|
|
"description": "Authentication type for MCP connection"
|
|
},
|
|
"oauthConfigId": {
|
|
"type": "string",
|
|
"description": "OAuth config ID reference"
|
|
},
|
|
"headers": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Headers for auth"
|
|
},
|
|
"stdioConfig": {
|
|
"type": "object",
|
|
"properties": {
|
|
"command": {
|
|
"type": "string"
|
|
},
|
|
"args": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"envs": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"required": ["command"]
|
|
},
|
|
"websocketConfig": {
|
|
"type": "object",
|
|
"properties": {
|
|
"url": {
|
|
"type": "string",
|
|
"format": "uri"
|
|
}
|
|
},
|
|
"required": ["url"]
|
|
},
|
|
"httpConfig": {
|
|
"type": "object",
|
|
"properties": {
|
|
"url": {
|
|
"type": "string",
|
|
"format": "uri"
|
|
}
|
|
},
|
|
"required": ["url"]
|
|
},
|
|
"toolsToExecute": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Include-only list of tools to execute"
|
|
},
|
|
"toolsToAutoExecute": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Auto-execute list of tools"
|
|
},
|
|
"toolSyncInterval": {
|
|
"type": "string",
|
|
"description": "Per-client override for tool sync interval"
|
|
},
|
|
"toolExecutionTimeout": {
|
|
"type": ["string", "integer"],
|
|
"description": "Per-client override for tool execution timeout. Go duration string (e.g. '30s', '2m') or a bare integer treated as seconds. Overrides the global mcp.toolManagerConfig.toolExecutionTimeout for this server only. Omit or set to 0 to use the global default."
|
|
},
|
|
"isPingAvailable": {
|
|
"type": "boolean",
|
|
"description": "Whether the MCP server supports ping"
|
|
},
|
|
"toolPricing": {
|
|
"type": "object",
|
|
"description": "Tool pricing map (tool name to cost per execution)",
|
|
"additionalProperties": {
|
|
"type": "number",
|
|
"minimum": 0
|
|
}
|
|
},
|
|
"allowedExtraHeaders": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Allowlist of request-level headers that callers may forward to this MCP server. Use ['*'] to allow all headers."
|
|
},
|
|
"allowOnAllVirtualKeys": {
|
|
"type": "boolean",
|
|
"description": "When true, this MCP server is accessible to all virtual keys without requiring explicit per-key assignment.",
|
|
"default": false
|
|
},
|
|
"tlsConfig": {
|
|
"type": "object",
|
|
"description": "[Upcoming] TLS configuration for HTTP and SSE connection types. Not applicable to stdio or inprocess.",
|
|
"properties": {
|
|
"insecureSkipVerify": {
|
|
"type": "boolean",
|
|
"description": "Disable TLS certificate verification. Takes priority over caCertPem. Development/testing only.",
|
|
"default": false
|
|
},
|
|
"caCertPem": {
|
|
"type": "string",
|
|
"description": "PEM-encoded CA certificate for MCP server connections. Accepts a literal PEM string or an env.VAR_NAME reference."
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"required": ["name", "connectionType"],
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"connectionType": {
|
|
"const": "stdio"
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["stdioConfig"]
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"connectionType": {
|
|
"const": "websocket"
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["websocketConfig"]
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"connectionType": {
|
|
"const": "http"
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["httpConfig"]
|
|
}
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"connectionType": {
|
|
"const": "sse"
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": ["connectionString"]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"mcpToolGroupConfig": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string",
|
|
"description": "Tool group name"
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"description": "Tool group description"
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether tool group is enabled",
|
|
"default": true
|
|
},
|
|
"tools": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"description": "MCP tools included in this group",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"mcpClientId": {
|
|
"type": "string",
|
|
"description": "MCP client ID"
|
|
},
|
|
"mcpClientName": {
|
|
"type": "string",
|
|
"description": "MCP client name (resolved to client_id at startup)"
|
|
},
|
|
"toolNames": {
|
|
"type": "array",
|
|
"description": "Tool names to allow. Empty means all tools from this MCP client.",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"oneOf": [
|
|
{
|
|
"required": ["mcpClientId"]
|
|
},
|
|
{
|
|
"required": ["mcpClientName"]
|
|
}
|
|
],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"virtualKeyIds": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"teamIds": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"customerIds": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"userIds": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"providerNames": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"apiKeyIds": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "integer"
|
|
}
|
|
}
|
|
},
|
|
"required": ["name", "tools"],
|
|
"additionalProperties": false
|
|
},
|
|
"virtualKeyProviderConfig": {
|
|
"type": "object",
|
|
"description": "Provider configuration for a virtual key",
|
|
"properties": {
|
|
"id": {
|
|
"type": "integer",
|
|
"description": "Provider config ID"
|
|
},
|
|
"virtual_key_id": {
|
|
"type": "string",
|
|
"description": "Associated virtual key ID"
|
|
},
|
|
"provider": {
|
|
"type": "string",
|
|
"description": "Provider name"
|
|
},
|
|
"weight": {
|
|
"type": "number",
|
|
"description": "Weight for load balancing",
|
|
"default": 1.0
|
|
},
|
|
"allowed_models": {
|
|
"type": "array",
|
|
"description": "Allowed models for this provider config. Use [\"*\"] to allow all models; empty array denies all (deny-by-default).",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"blacklisted_models": {
|
|
"type": "array",
|
|
"description": "Models blocked for this provider config even if matched by allowed_models. Use [\"*\"] to block all.",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"budget_id": {
|
|
"type": "string",
|
|
"description": "Associated budget ID"
|
|
},
|
|
"rate_limit_id": {
|
|
"type": "string",
|
|
"description": "Associated rate limit ID"
|
|
},
|
|
"key_ids": {
|
|
"type": "array",
|
|
"description": "Key identifiers allowed for this provider config. Use [\"*\"] to allow all keys; empty array denies all (deny-by-default).",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"keys": {
|
|
"type": "array",
|
|
"description": "Provider keys for this config (empty means all keys allowed for this provider)",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "integer",
|
|
"description": "Key database ID (auto-generated)"
|
|
},
|
|
"key_id": {
|
|
"type": "string",
|
|
"description": "Key UUID identifier"
|
|
},
|
|
"name": {
|
|
"type": "string",
|
|
"description": "Key name (must be unique)"
|
|
},
|
|
"value": {
|
|
"type": "string",
|
|
"description": "API key value (can use env. prefix)"
|
|
},
|
|
"models": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Models this key can access. Use [\"*\"] to allow all models; empty array denies all (deny-by-default)."
|
|
},
|
|
"weight": {
|
|
"type": "number",
|
|
"minimum": 0,
|
|
"default": 1.0,
|
|
"description": "Weight for load balancing"
|
|
},
|
|
"azure_key_config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"endpoint": {
|
|
"type": "string",
|
|
"description": "Azure endpoint (can use env. prefix)"
|
|
},
|
|
"client_id": {
|
|
"type": "string",
|
|
"description": "Azure client ID for authentication (can use env. prefix)"
|
|
},
|
|
"client_secret": {
|
|
"type": "string",
|
|
"description": "Azure client secret for authentication (can use env. prefix)"
|
|
},
|
|
"tenant_id": {
|
|
"type": "string",
|
|
"description": "Azure tenant ID for authentication (can use env. prefix)"
|
|
},
|
|
"scopes": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"description": "Azure scopes for authentication"
|
|
},
|
|
"deployments": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Model to deployment mappings"
|
|
},
|
|
"api_version": {
|
|
"type": "string",
|
|
"description": "Azure API version"
|
|
}
|
|
},
|
|
"dependentRequired": {
|
|
"client_id": ["client_secret", "tenant_id"],
|
|
"client_secret": ["client_id", "tenant_id"],
|
|
"tenant_id": ["client_id", "client_secret"]
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"vertex_key_config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"project_id": {
|
|
"type": "string",
|
|
"description": "Google Cloud project ID (can use env. prefix)"
|
|
},
|
|
"project_number": {
|
|
"type": "string",
|
|
"description": "Google Cloud project number"
|
|
},
|
|
"region": {
|
|
"type": "string",
|
|
"description": "Google Cloud region"
|
|
},
|
|
"auth_credentials": {
|
|
"type": "string",
|
|
"description": "Authentication credentials (can use env. prefix)"
|
|
},
|
|
"deployments": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Model to deployment mappings"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"bedrock_key_config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"access_key": {
|
|
"type": "string",
|
|
"description": "AWS access key (can use env. prefix)"
|
|
},
|
|
"secret_key": {
|
|
"type": "string",
|
|
"description": "AWS secret key (can use env. prefix)"
|
|
},
|
|
"session_token": {
|
|
"type": "string",
|
|
"description": "AWS session token (can use env. prefix)"
|
|
},
|
|
"region": {
|
|
"type": "string",
|
|
"description": "AWS region"
|
|
},
|
|
"arn": {
|
|
"type": "string",
|
|
"description": "AWS ARN"
|
|
},
|
|
"role_arn": {
|
|
"type": "string",
|
|
"description": "AWS IAM role ARN for AssumeRole (can use env. prefix)"
|
|
},
|
|
"external_id": {
|
|
"type": "string",
|
|
"description": "External ID for AssumeRole (can use env. prefix)"
|
|
},
|
|
"session_name": {
|
|
"type": "string",
|
|
"description": "Role session name for AssumeRole (can use env. prefix)"
|
|
},
|
|
"deployments": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Model to deployment mappings"
|
|
},
|
|
"batch_s3_config": {
|
|
"type": "object",
|
|
"description": "S3 bucket configuration for Bedrock batch operations",
|
|
"properties": {
|
|
"buckets": {
|
|
"type": "array",
|
|
"description": "List of S3 bucket configurations",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"bucket_name": {
|
|
"type": "string",
|
|
"description": "S3 bucket name"
|
|
},
|
|
"prefix": {
|
|
"type": "string",
|
|
"description": "S3 key prefix for batch files"
|
|
},
|
|
"is_default": {
|
|
"type": "boolean",
|
|
"description": "Whether this is the default bucket for batch operations"
|
|
}
|
|
},
|
|
"required": ["bucket_name"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"vllm_key_config": {
|
|
"type": "object",
|
|
"properties": {
|
|
"url": {
|
|
"type": "string",
|
|
"description": "VLLM server base URL (can use env. prefix)"
|
|
},
|
|
"model_name": {
|
|
"type": "string",
|
|
"description": "Exact model name served on this VLLM instance"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"oneOf": [
|
|
{
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["azure_key_config"]
|
|
},
|
|
{
|
|
"required": ["vertex_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"]
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": ["azure_key_config"],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["vertex_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"]
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": ["vertex_key_config"],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["azure_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"]
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["azure_key_config"]
|
|
},
|
|
{
|
|
"required": ["vertex_key_config"]
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": ["vllm_key_config"],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": ["azure_key_config"]
|
|
},
|
|
{
|
|
"required": ["vertex_key_config"]
|
|
},
|
|
{
|
|
"required": ["bedrock_key_config"]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"required": ["provider"],
|
|
"additionalProperties": false
|
|
},
|
|
"scim_attribute_role_mappings": {
|
|
"type": "array",
|
|
"description": "Ordered list of attribute -> role mappings (first match wins).",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"attribute": {
|
|
"type": "string",
|
|
"description": "JWT claim name (supports dot paths, e.g. 'realm_access.roles')"
|
|
},
|
|
"value": {
|
|
"type": "string",
|
|
"description": "Claim value to match (case-insensitive)"
|
|
},
|
|
"role": {
|
|
"type": "string",
|
|
"description": "Bifrost role to assign on match"
|
|
}
|
|
},
|
|
"required": ["attribute", "value", "role"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"scim_attribute_team_mappings": {
|
|
"type": "array",
|
|
"description": "Attribute -> team mappings (all matches apply). Use value '*' for pass-through.",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"attribute": {
|
|
"type": "string",
|
|
"description": "JWT claim name"
|
|
},
|
|
"value": {
|
|
"type": "string",
|
|
"description": "Claim value to match, or '*' for pass-through"
|
|
},
|
|
"team": {
|
|
"type": "string",
|
|
"description": "Bifrost team slug to assign. In case of '*' value, leave this empty"
|
|
}
|
|
},
|
|
"required": ["attribute", "value"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"scim_attribute_business_unit_mappings": {
|
|
"type": "array",
|
|
"description": "Attribute -> business-unit mappings (all matches apply).",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"attribute": {
|
|
"type": "string",
|
|
"description": "JWT claim name"
|
|
},
|
|
"value": {
|
|
"type": "string",
|
|
"description": "Claim value to match. Wildcard '*' will use the claim as the name of the business unit to assign."
|
|
},
|
|
"business_unit": {
|
|
"type": "string",
|
|
"description": "Bifrost business unit slug to assign. In case of '*' value, leave this empty"
|
|
}
|
|
},
|
|
"required": ["attribute", "value"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"scim_claim_attributes": {
|
|
"type": "object",
|
|
"description": "Per-claim SCIM interpretation. Maps each claim name to its SCIM source type and attribute key. Set by the UI when SCIM provisioning is configured.",
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"properties": {
|
|
"attributeType": {
|
|
"type": "string",
|
|
"enum": ["user", "group"],
|
|
"description": "'user' reads from SCIM User resource attributes; 'group' matches SCIM Group resource."
|
|
},
|
|
"attributeValue": {
|
|
"type": "string",
|
|
"description": "SCIM attribute key or group match field for this claim."
|
|
}
|
|
},
|
|
"required": ["attributeType", "attributeValue"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|
|
}
|